CWE-523 Unprotected Transport of Credentials
baseLogin pages do not use adequate measures to protect the user name and password while they are in transit from the client to the server.
01
parent weaknesses
Broader classes this is a kind of.
02
vulnerabilities (32)
Known CVEs related to this entry.
| ID | severity | exploitable | ||
|---|---|---|---|---|
| CVE-2021-37400US | critical9.8 | — | ||
An attacker may obtain the user credentials from the communication between the PLC and the software. As a result, the PLC user program may be uploaded, altered, and/or downloaded. | ||||
| CVE-2021-27023US | critical9.8 | — | ||
A flaw was discovered in Puppet Agent and Puppet Server that may result in a leak of HTTP credentials when following HTTP redirects to a different host. This is similar to CVE-2018… | ||||
| CVE-2020-25175US | critical9.8 | — | ||
GE Healthcare Imaging and Ultrasound Products may allow specific credentials to be exposed during transport over the network. | ||||
| CVE-2026-8673US | critical9.1 | — | ||
Unprotected transport of credentials vulnerability in syslink software AG Avantra on Linux, Windows allows Sniffing Attacks.
This issue affects Avantra: before 25.3.0. | ||||
| CVE-2024-1509US | critical9.1 | — | ||
Brocade ASCG before 3.2.0 Web Interface is not
enforcing HSTS, as defined by RFC 6797. HSTS is an optional response
header that can be configured on the server to instruct the b… | ||||
| CVE-2017-16731US | high8.8 | — | ||
An Unprotected Transport of Credentials issue was discovered in ABB Ellipse 8.3 through Ellipse 8.9 released prior to December 2017 (including Ellipse Select). A vulnerability exis… | ||||
| CVE-2021-38460US | high7.5 | — | ||
A path traversal vulnerability in the Moxa MXview Network Management software Versions 3.x to 3.2.2 may allow an attacker to create or overwrite critical files used to execute code… | ||||
| CVE-2023-31277US | high7.5 | — | ||
PiiGAB M-Bus transmits credentials in plaintext format.
| ||||
| CVE-2023-22862US | high7.5 | — | ||
IBM Aspera Connect 4.2.5 and IBM Aspera Cargo 4.2.5 transmits authentication credentials, but it uses an insecure method that is susceptible to unauthorized interception and/or ret… | ||||
| CVE-2021-20826US | high7.6 | — | ||
Unprotected transport of credentials vulnerability in IDEC PLCs (FC6A Series MICROSmart All-in-One CPU module v2.32 and earlier, FC6A Series MICROSmart Plus CPU module v1.91 and ea… | ||||
| CVE-2024-20395US | high7.3 | — | ||
A vulnerability in the media retrieval functionality of Cisco Webex App could allow an unauthenticated, adjacent attacker to gain access to sensitive session information.
This v… | ||||
| CVE-2026-23635US | medium6.5 | — | ||
Kiteworks is a private data network (PDN). In Kiteworks Secure Data Forms prior to version 9.2.1, a misconfiguration of the security attributes could potentially lead to Unprotecte… | ||||
| CVE-2025-61916US | medium6.6 | — | ||
Spinnaker is an open source, multi-cloud continuous delivery platform. Versions prior to 2025.1.6, 2025.2.3, and 2025.3.0 are vulnerable to server-side request forgery. The primary… | ||||
| CVE-2020-27270US | medium5.7 | — | ||
SOOIL Developments CoLtd DiabecareRS, AnyDana-i ,AnyDana-A, communication protocol of the insulin pump & AnyDana-i,AnyDana-A mobile apps doesnt use adequate measures to protect enc… | ||||
| CVE-2021-32003US | medium5.5 | — | ||
Unprotected Transport of Credentials vulnerability in SiteManager provisioning service allows local attacker to capture credentials if the service is used after provisioning. This… | ||||
| CVE-2026-17620US | high7.5 | — | ||
IBM Financial Transaction Manager (FTM) for RedHat OpenShift 4.0.6.0 through 4.0.6.0.0.6.0 Refresh (Operator 4.4.6+20260807.081800)4.0.7.04.0.8.04.0.9.04.0.10.0 Interim Fix 064 IBM… | ||||
| CVE-2023-28708US | medium4.3 | — | ||
When using the RemoteIpFilter with requests received from a reverse proxy via HTTP that include the X-Forwarded-Proto header set to https, session cookies created by Apache T… | ||||
| CVE-2022-31805US | medium4.3 | — | ||
In the CODESYS Development System multiple components in multiple versions transmit the passwords for the communication between clients and servers unprotected. | ||||
| CVE-2026-113866US | — | — | ||
When setting up an account, Thunderbird's Exchange AutoDiscover lookup also queried the domain's AutoDiscover service over plain HTTP. Due to a bug, that unencrypted request includ… | ||||
| CVE-2026-56587US | — | — | ||
HCL IEM was affected with Strict transport security not enforced. It may enable attackers to perform SSL stripping or man-in-the-middle attacks and compromise secure communications… | ||||
03
attack patterns (1)
CAPEC attack patterns that exploit this.
04
source
Where this definition is published.
MITREUS
scry
Weaknesses like this turn up in real, exploitable exposures. See what is exposed on your perimeter with a free passive scan.
Free scan