Unprotected Transport of Credentials
CWE-523
Login pages do not use adequate measures to protect the user name and password while they are in transit from the client to the server.
We track 11 vulnerabilities of this type. 100% are rated high or critical, and the average CVSS score is 7.8.
Latest Unprotected Transport of Credentials vulnerabilities
- 7.5 High severity
Financial Transaction Manager (FTM) for RedHat…: Unprotected Transport of Credentials
IBM Financial Transaction Manager (FTM) for RedHat OpenShift 4.0.6.0 through 4.0.6.0.0.6.0 Refresh (Operator 4.4.6+20260807.081800)4.0.7.04.0.8.04.0.9.04.0.10.0 Interim Fix 064 IBM Financial Transaction Manager transmits sensitive or security-critical data in
- 7.4 High severity
CoreWCF: Missing Encryption of Sensitive Data
CoreWCF is a port of the service side of Windows Communication Foundation (WCF) to .NET Core. In version 1.9.0, CoreWCF SPNEGO SecurityContextToken negotiation can expose the proof key recovered from the RSTR when TransportWithMessageCredential with Windows cl
- 9.1 Critical severity
Avantra: Unprotected Transport of Credentials
Unprotected transport of credentials vulnerability in syslink software AG Avantra on Linux, Windows allows Sniffing Attacks. This issue affects Avantra: before 25.3.0.
- 7.6 High severity
ondemand: Insufficiently Protected Credentials
Open OnDemand provides remote web access to supercomputers. In versions 4.0.8 and prior, the Apache proxy allows sensitive headers to be passed to origin servers. This means malicious users can create an origin server on a compute node that record these header
- 7.4 High severity
Brightpick Mission Control / Internal Logic…: Unprotected Transport of Credentials
The affected product discloses device telemetry, configuration, and sensitive information via WebSocket traffic to unauthenticated users when they connect to a specific URL. The unauthenticated URL can be discovered through basic network scanning techniques.
- 8.8 High severity
audiobookshelf: Unprotected Transport of Credentials
Audiobookshelf is an open-source self-hosted audiobook server. In versions 2.6.0 through 2.26.3, the application does not properly restrict redirect callback URLs during OIDC authentication. An attacker can craft a login link that causes Audiobookshelf to stor
- 9.1 Critical severity
ASCG: Unprotected Transport of Credentials
Brocade ASCG before 3.2.0 Web Interface is not enforcing HSTS, as defined by RFC 6797. HSTS is an optional response header that can be configured on the server to instruct the browser to only communicate via HTTPS. The lack of HSTS allows downgrade attacks, SS
- 7.1 High severity
Documentum™ Server: Unprotected Transport of Credentials
Unprotected Transport of Credentials vulnerability in OpenText™ Documentum™ Server could allow Credential Stuffing.This issue affects Documentum™ Server: from 16.7 through 23.4.
- 7.3 High severity
Cisco Webex Teams: Unprotected Transport of Credentials
A vulnerability in the media retrieval functionality of Cisco Webex App could allow an unauthenticated, adjacent attacker to gain access to sensitive session information. This vulnerability is due to insecure transmission of requests to backend services when t
- 7.5 High severity
Aspera Connect: Insufficiently Protected Credentials
IBM Aspera Connect 4.2.5 and IBM Aspera Cargo 4.2.5 transmits authentication credentials, but it uses an insecure method that is susceptible to unauthorized interception and/or retrieval.
- 7.5 High severity
CODESYS Development System: Unprotected Transport of Credentials
In the CODESYS Development System multiple components in multiple versions transmit the passwords for the communication between clients and servers unprotected.