Insufficiently Protected Credentials
CWE-522
The product transmits or stores authentication credentials, but it uses an insecure method that is susceptible to unauthorized interception and/or retrieval.
We track 328 vulnerabilities of this type. 100% are rated high or critical, and the average CVSS score is 8.4. 5 have been exploited in real attacks.
How this weakness is prevented
- Architecture and Design: Use an appropriate security mechanism to protect the credentials.
- Architecture and Design: Make appropriate use of cryptography to protect the credentials.
- Implementation: Use industry standards to protect the credentials (e.g. LDAP, keystore, etc.).
Latest Insufficiently Protected Credentials vulnerabilities
- 8.6 High severity
Dvc-215ip Firmware: Insufficiently Protected Credentials
Settings/network settings/wireless settings on the Alecto DVC-215IP camera version 63.1.1.173 and below shows the Wi-Fi passphrase hidden, but by editing/removing the style of the password field the password becomes visible which grants access to an internal n
- 7.5 High severity
Apache ShenYu (incubating): Insufficiently Protected Credentials
On Apache ShenYu versions 2.4.0 and 2.4.1, and endpoint existed that disclosed the passwords of all users. Users are recommended to upgrade to version 2.4.2 or later.
- 7.5 High severity
Jenkins Conjur Secrets Plugin: Insufficiently Protected Credentials
Jenkins Conjur Secrets Plugin 1.0.9 and earlier implements functionality that allows attackers able to control agent processes to retrieve all username/password credentials stored on the Jenkins controller.
- 9.8 Critical severity
Kaseya Virtual System/Server Administrator (VSA) Information Disclosure Exploited
Kaseya VSA before 9.5.7 allows credential disclosure, as exploited in the wild in July 2021. By default Kaseya VSA on premise offers a download page where the clients for the installation can be downloaded. The default URL for this page is https://x.x.x.x/dl.a
- 9.8 Critical severity
Rockwell Multiple Products Insufficient Protected Credentials Exploited
Rockwell Automation Studio 5000 Logix Designer Versions 21 and later, and RSLogix 5000 Versions 16 through 20 use a key to verify Logix controllers are communicating with Rockwell Automation CompactLogix 1768, 1769, 5370, 5380, 5480: ControlLogix 5550, 5560, 5
- 9.8 Critical severity
Zyxel Multiple Products Use of Hard-Coded Credentials Exploited
Firmware version 4.60 of Zyxel USG devices contains an undocumented account (zyfwp) with an unchangeable password. The password for this account can be found in cleartext in the firmware. This account can be used by someone to login to the ssh server or web in
- 9.8 Critical severity
Progress Telerik UI for ASP.NET AJAX and Sitefinity Cryptographic Weakness Exploited
Telerik.Web.UI.dll in Progress Telerik UI for ASP.NET AJAX before R2 2017 SP1 and Sitefinity before 10.0.6412.0 does not properly protect Telerik.Web.UI.DialogParametersEncryptionKey or the MachineKey, which makes it easier for remote attackers to defeat crypt
- 9.0 High severity
Microsoft Windows Group Policy Preferences Password Privilege Escalation Exploited
The Group Policy implementation in Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows 8.1, and Windows Server 2012 Gold and R2 does not properly handle distribution of passwords, which allows remote authenticated