Filtered by CWE-522
Filtered by vendor Subscriptions
Total 1126 CVE
CVE Vendors Products Updated CVSS v3.1
CVE-2023-25495 1 Lenovo 218 Thinkagile Hx1021, Thinkagile Hx1021 Firmware, Thinkagile Hx1320 and 215 more 2024-11-21 4.9 Medium
A valid, authenticated administrative user can query a web interface API to reveal the configured LDAP client password used by XCC to authenticate to an external LDAP server in certain configurations. There is no exposure where no LDAP client password is configured
CVE-2023-25413 1 Aten 2 Pe8108, Pe8108 Firmware 2024-11-21 7.5 High
Aten PE8108 2.4.232 is vulnerable to Incorrect Access Control. The device allows unauthenticated access to Telnet and SNMP credentials.
CVE-2023-25407 1 Aten 2 Pe8108, Pe8108 Firmware 2024-11-21 7.2 High
Aten PE8108 2.4.232 is vulnerable to Incorrect Access Control. Restricted users have read access to administrator credentials.
CVE-2023-25191 1 Ami 1 Megarac Sp-x 2024-11-21 7.5 High
AMI MegaRAC SPX devices allow Password Disclosure through Redfish. The fixed versions are SPx_12-update-7.00 and SPx_13-update-5.00.
CVE-2023-24619 1 Redpanda 1 Redpanda 2024-11-21 5.5 Medium
Redpanda before 22.3.12 discloses cleartext AWS credentials. The import functionality in the rpk binary logs an AWS Access Key ID and Secret in cleartext to standard output, allowing a local user to view the key in the console, or in Kubernetes logs if stdout output is collected. The fixed versions are 22.3.12, 22.2.10, and 22.1.12.
CVE-2023-24506 1 Milesight 2 Ncr\/camera, Ncr\/camera Firmware 2024-11-21 7.5 High
Milesight NCR/camera version 71.8.0.6-r5 exposes credentials through an unspecified request.
CVE-2023-24498 1 Netgear 2 Prosafe Fs726tp, Prosafe Fs726tp Firmware 2024-11-21 7.5 High
An uspecified endpoint in the web server of the switch does not properly authenticate the user identity, and may allow downloading a config page with the password to the switch in clear text.
CVE-2023-24047 1 Connectize 2 Ac21000 G6, Ac21000 G6 Firmware 2024-11-21 6.8 Medium
An Insecure Credential Management issue discovered in Connectize AC21000 G6 641.139.1.1256 allows attackers to gain escalated privileges via use of weak hashing algorithm.
CVE-2023-23466 1 Mediacp 1 Media Control Panel 2024-11-21 6.5 Medium
Media CP Media Control Panel latest version. Insufficiently protected credential change.
CVE-2023-23463 1 Sunellsecurity 14 Sn-adr3804e1, Sn-adr3804e1 Firmware, Sn-adr3808e1 and 11 more 2024-11-21 5.3 Medium
Sunell DVR, latest version, Insufficiently Protected Credentials (CWE-522) may be exposed through an unspecified request.
CVE-2023-23370 1 Qnap 1 Qvpn 2024-11-21 6.7 Medium
An insufficiently protected credentials vulnerability has been reported to affect QVPN Device Client. If exploited, the vulnerability could allow local authenticated administrators to gain access to user accounts and access sensitive data used by the user account via unspecified vectors. We have already fixed the vulnerability in the following version: QVPN Windows 2.1.0.0518 and later
CVE-2023-22862 1 Ibm 2 Aspera Cargo, Aspera Connect 2024-11-21 5.9 Medium
IBM Aspera Connect 4.2.5 and IBM Aspera Cargo 4.2.5 transmits authentication credentials, but it uses an insecure method that is susceptible to unauthorized interception and/or retrieval.
CVE-2023-20965 1 Google 1 Android 2024-11-21 9.8 Critical
In processMessageImpl of ClientModeImpl.java, there is a possible credential disclosure in the TOFU flow due to a logic error in the code. This could lead to remote escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.
CVE-2023-20046 1 Cisco 6 Asr 5000, Asr 5500, Asr 5700 and 3 more 2024-11-21 8.8 High
A vulnerability in the key-based SSH authentication feature of Cisco StarOS Software could allow an authenticated, remote attacker to elevate privileges on an affected device. This vulnerability is due to insufficient validation of user-supplied credentials. An attacker could exploit this vulnerability by sending a valid low-privileged SSH key to an affected device from a host that has an IP address that is configured as the source for a high-privileged user account. A successful exploit could allow the attacker to log in to the affected device through SSH as a high-privileged user. There are workarounds that address this vulnerability.
CVE-2023-1778 1 Gajshield 2 Data Security Firewall, Data Security Firewall Firmware 2024-11-21 10 Critical
This vulnerability exists in GajShield Data Security Firewall firmware versions prior to v4.28 (except v4.21) due to insecure default credentials which allows remote attacker to login as superuser by using default username/password via web-based management interface and/or exposed SSH port thereby enabling remote attackers to execute arbitrary commands with administrative/superuser privileges on the targeted systems. The vulnerability has been addressed by forcing the user to change their default password to a new non-default password.
CVE-2023-1763 2 Apple, Canon 3 Mac Os X, Macos, Ij Network Tool 2024-11-21 6.5 Medium
Canon IJ Network Tool/Ver.4.7.5 and earlier (supported OS: OS X 10.9.5-macOS 13),IJ Network Tool/Ver.4.7.3 and earlier (supported OS: OS X 10.7.5-OS X 10.8) allows an attacker to acquire sensitive information on the Wi-Fi connection setup of the printer from the software.
CVE-2023-1633 2 Openstack, Redhat 3 Barbican, Openstack, Openstack Platform 2024-11-21 6.6 Medium
A credentials leak flaw was found in OpenStack Barbican. This flaw allows a local authenticated attacker to read the configuration file, gaining access to sensitive credentials.
CVE-2023-1574 1 Devolutions 1 Remote Desktop Manager 2024-11-21 6.5 Medium
Information disclosure in the user creation feature of a MSSQL data source in Devolutions Remote Desktop Manager 2023.1.9 and below on Windows allows an attacker with access to the user interface to obtain sensitive information via the error message dialog that displays the password in clear text.
CVE-2023-1518 1 Cpplusworld 1 Kvms Pro 2024-11-21 7.8 High
CP Plus KVMS Pro versions 2.01.0.T.190521 and prior are vulnerable to sensitive credentials being leaked because they are insufficiently protected.  
CVE-2023-1137 1 Deltaww 1 Infrasuite Device Master 2024-11-21 6.5 Medium
Delta Electronics InfraSuite Device Master versions prior to 1.0.5 contain a vulnerability in which a low-level user could extract files and plaintext credentials of administrator users, resulting in privilege escalation.