CWE-523 · 23 records

Unprotected Transport of Credentials

CVEs in this class

23 records

CVE records
Action	CVE	Vulnerability	Severity	KEV	EPSS	Published
39Monitor	CVE-2020-25175No exploit	GE Healthcare Imaging and Ultrasound Products may allow specific credentials to be exposed during transport over the network.gehealthcare · 3.0t signa hdxt firmware · CWE-523 Pre-auth	Critical9.8	—	1.1%	Dec 14, 2020
36Monitor	CVE-2026-8673No exploit	Password re-initialization mechanism sends passwords in plain textavantra · avantra · CWE-523 Pre-auth	Critical9.1	—	0.1%	May 22, 2026
35Monitor	CVE-2017-16731No exploit	An Unprotected Transport of Credentials issue was discovered in ABB Ellipse 8.3 through Ellipse 8.9 released prior to December 2017 (includihitachienergy · ellipse · CWE-523 Pre-auth	High8.8	—	0.7%	Dec 20, 2017
35Monitor	CVE-2025-57800No exploit	Audiobookshelf vulnerable to OIDC token exfiltration and account takeoveraudiobookshelf · audiobookshelf · CWE-523 Pre-auth	High8.8	—	0.4%	Aug 22, 2025
31Monitor	CVE-2021-38460No exploit	Moxa MXview Network Management Softwaremoxa · mxview · CWE-523 Pre-auth Path traversal	High7.5	—	1.8%	Oct 12, 2021
30Monitor	CVE-2022-31805No exploit	Insecure transmission of credentialscodesys · development system · CWE-523 Pre-auth	High7.5	—	1.0%	Jun 24, 2022
30Monitor	CVE-2023-22862No exploit	IBM Aspera information disclosureibm · aspera cargo · CWE-523 Pre-auth	High7.5	—	0.6%	Jun 4, 2023
30Monitor	CVE-2023-31277No exploit	PiiGAB M-Bus Unprotected Transport of Credentialspiigab · m-bus 900s firmware · CWE-523 Pre-auth	High7.5	—	0.5%	Jul 6, 2023
30Monitor	CVE-2024-1509No exploit	Brocade ASCG 3.2.0 web interface does not enforce HSTS, as defined by RFC 6797 for ports 8030 and 8100broadcom · brocade active support connectivity gateway · CWE-523 Pre-auth	High7.6	—	0.3%	Feb 28, 2025
30Monitor	CVE-2025-61121No exploit	Mobile Scanner Android App version 2.12.38 (package name com.glority.everlens), developed by Glority Global Group Ltd., contains a credentiaCWE-523 Pre-auth	High7.5	—	0.3%	Oct 30, 2025
30Monitor	CVE-2026-17620No exploit	IBM Financial Transaction Manager (FTM) is Impacted by Multiple Vulnerabilitiesibm · financial transaction manager · CWE-523 Pre-auth	High7.5	—	0.2%	Sep 22, 2026
29Monitor	CVE-2024-20395No exploit	A vulnerability in the media retrieval functionality of Cisco Webex App could allow an unauthenticated, adjacent attacker to gain access to cisco · webex teams · CWE-523 Pre-auth	High7.3	—	0.2%	Jul 17, 2024
28Monitor	CVE-2025-64308No exploit	Brightpick Mission Control / Internal Logic Control Unprotected Transport of Credentialsbrightpick ai · brightpick mission control / internal logic control · CWE-523 Pre-auth Hard-coded credentials	High7.1	—	0.2%	Nov 15, 2025
28Monitor	CVE-2024-4188No exploit	Security vulnerability exists in Documentum server cloud releases that could allow access to sensitive information which can impact system Operation.opentext™ · documentum™ server · CWE-523	High7.1	—	0.1%	Jul 30, 2024
27Monitor	CVE-2025-41705No exploit	Phoenix Contact: WebSocket Message Interception Leaks Webfrontend Credentialsphoenix contact · quint4-ups/24dc/24dc/5/eip · CWE-523 Pre-auth	Medium6.8	—	0.4%	Oct 14, 2025
26Monitor	CVE-2024-1102No exploit	Jberet: jberet-core logging database credentialsjberet · jberet · CWE-523	Medium6.5	—	0.8%	Apr 25, 2024
26Monitor	CVE-2026-23635No exploit	Kiteworks Secure Data Forms has a potential Unprotected Transport of Credentialsaccellion · kiteworks · CWE-523 Pre-auth	Medium6.5	—	0.3%	Mar 25, 2026
24Monitor	CVE-2025-64309No exploit	Brightpick Mission Control / Internal Logic Control Unprotected Transport of Credentialsbrightpick ai · brightpick mission control / internal logic control · CWE-523 Pre-auth	Medium6.0	—	0.2%	Nov 15, 2025
23Monitor	CVE-2026-113866No exploit	Account password sent unencrypted during Exchange account setupmozilla · thunderbird · CWE-523 Pre-auth	Medium5.9	—	0.3%	Oct 20, 2026
22Monitor	CVE-2021-32003No exploit	Configuration service port remains open 10 minutes after reboot even when already provisionedsecomea · sitemanager firmware · CWE-523	Medium5.5	—	0.2%	Aug 5, 2021
18Monitor	CVE-2023-28708No exploit	Apache Tomcat: JSESSIONID Cookie missing secure attribute in some configurationsapache · tomcat · CWE-523 Pre-auth	Medium4.3	—	1.8%	Mar 22, 2023
14Monitor	CVE-2026-56587No exploit	HCL IEM was affected with Strict transport security not enforcedhcltech · intelliops event management · CWE-523 Pre-auth	Low3.7	—	0.2%	Jul 21, 2026
9Monitor	CVE-2026-8668No exploit	Hardcoded credentials in embedded contentprogress chef · chef360 · CWE-523 Auth bypass Hard-coded credentials	Low2.3	—	0.2%	Jun 18, 2026

CVE-2020-25175
39Monitor
GE Healthcare Imaging and Ultrasound Products may allow specific credentials to be exposed during transport over the network.
CriticalCVSS 9.8No exploitEPSS 1%
- Pre-auth
gehealthcare · 3.0t signa hdxt firmwareDec 14, 2020
CVE-2026-8673
36Monitor
Password re-initialization mechanism sends passwords in plain text
CriticalCVSS 9.1No exploitEPSS 0%
- Pre-auth
avantra · avantraMay 22, 2026
CVE-2017-16731
35Monitor
An Unprotected Transport of Credentials issue was discovered in ABB Ellipse 8.3 through Ellipse 8.9 released prior to December 2017 (includi
HighCVSS 8.8No exploitEPSS 0%
- Pre-auth
hitachienergy · ellipseDec 20, 2017
CVE-2025-57800
35Monitor
Audiobookshelf vulnerable to OIDC token exfiltration and account takeover
HighCVSS 8.8No exploitEPSS 0%
- Pre-auth
audiobookshelf · audiobookshelfAug 22, 2025
CVE-2021-38460
31Monitor
Moxa MXview Network Management Software
HighCVSS 7.5No exploitEPSS 1%
- Pre-auth
- Path traversal
moxa · mxviewOct 12, 2021
CVE-2022-31805
30Monitor
Insecure transmission of credentials
HighCVSS 7.5No exploitEPSS 1%
- Pre-auth
codesys · development systemJun 24, 2022
CVE-2023-22862
30Monitor
IBM Aspera information disclosure
HighCVSS 7.5No exploitEPSS 0%
- Pre-auth
ibm · aspera cargoJun 4, 2023
CVE-2023-31277
30Monitor
PiiGAB M-Bus Unprotected Transport of Credentials
HighCVSS 7.5No exploitEPSS 0%
- Pre-auth
piigab · m-bus 900s firmwareJul 6, 2023
CVE-2024-1509
30Monitor
Brocade ASCG 3.2.0 web interface does not enforce HSTS, as defined by RFC 6797 for ports 8030 and 8100
HighCVSS 7.6No exploitEPSS 0%
- Pre-auth
broadcom · brocade active support connectivity gatewayFeb 28, 2025
CVE-2025-61121
30Monitor
Mobile Scanner Android App version 2.12.38 (package name com.glority.everlens), developed by Glority Global Group Ltd., contains a credentia
HighCVSS 7.5No exploitEPSS 0%
- Pre-auth
Oct 30, 2025
CVE-2026-17620
30Monitor
IBM Financial Transaction Manager (FTM) is Impacted by Multiple Vulnerabilities
HighCVSS 7.5No exploitEPSS 0%
- Pre-auth
ibm · financial transaction managerSep 22, 2026
CVE-2024-20395
29Monitor
A vulnerability in the media retrieval functionality of Cisco Webex App could allow an unauthenticated, adjacent attacker to gain access to
HighCVSS 7.3No exploitEPSS 0%
- Pre-auth
cisco · webex teamsJul 17, 2024
CVE-2025-64308
28Monitor
Brightpick Mission Control / Internal Logic Control Unprotected Transport of Credentials
HighCVSS 7.1No exploitEPSS 0%
- Pre-auth
- Hard-coded credentials
brightpick ai · brightpick mission control / internal logic controlNov 15, 2025
CVE-2024-4188
28Monitor
Security vulnerability exists in Documentum server cloud releases that could allow access to sensitive information which can impact system Operation.
HighCVSS 7.1No exploitEPSS 0%
opentext™ · documentum™ serverJul 30, 2024
CVE-2025-41705
27Monitor
Phoenix Contact: WebSocket Message Interception Leaks Webfrontend Credentials
MediumCVSS 6.8No exploitEPSS 0%
- Pre-auth
phoenix contact · quint4-ups/24dc/24dc/5/eipOct 14, 2025
CVE-2024-1102
26Monitor
Jberet: jberet-core logging database credentials
MediumCVSS 6.5No exploitEPSS 0%
jberet · jberetApr 25, 2024
CVE-2026-23635
26Monitor
Kiteworks Secure Data Forms has a potential Unprotected Transport of Credentials
MediumCVSS 6.5No exploitEPSS 0%
- Pre-auth
accellion · kiteworksMar 25, 2026
CVE-2025-64309
24Monitor
Brightpick Mission Control / Internal Logic Control Unprotected Transport of Credentials
MediumCVSS 6.0No exploitEPSS 0%
- Pre-auth
brightpick ai · brightpick mission control / internal logic controlNov 15, 2025
CVE-2026-113866
23Monitor
Account password sent unencrypted during Exchange account setup
MediumCVSS 5.9No exploitEPSS 0%
- Pre-auth
mozilla · thunderbirdOct 20, 2026
CVE-2021-32003
22Monitor
Configuration service port remains open 10 minutes after reboot even when already provisioned
MediumCVSS 5.5No exploitEPSS 0%
secomea · sitemanager firmwareAug 5, 2021
CVE-2023-28708
18Monitor
Apache Tomcat: JSESSIONID Cookie missing secure attribute in some configurations
MediumCVSS 4.3No exploitEPSS 1%
- Pre-auth
apache · tomcatMar 22, 2023
CVE-2026-56587
14Monitor
HCL IEM was affected with Strict transport security not enforced
LowCVSS 3.7No exploitEPSS 0%
- Pre-auth
hcltech · intelliops event managementJul 21, 2026
CVE-2026-8668
9Monitor
Hardcoded credentials in embedded content
LowCVSS 2.3No exploitEPSS 0%
- Auth bypass
- Hard-coded credentials
progress chef · chef360Jun 18, 2026

All vulnerability classes