CWE-523 · Authentication
Unprotected Transport of Credentials
25CVEs
SortMost likely exploited
25 CVEs with CWE-523 as their weakness
| CVE · most likely exploited | CVSS | EPSS | Published |
|---|---|---|---|
| CVE-2023-28708Apache Tomcat: JSESSIONID Cookie missing secure attribute in some configurationsApache Software Foundation · Apache Tomcat · CVSS 4.3 · 2023-03-22 | 4.3 | 1.8% | 2023-03-22 |
| CVE-2021-38460Moxa MXview Network Management SoftwareMoxa · MXview Network Management Software · CVSS 7.5 · 2021-10-12 | 7.5 | 1.8% | 2021-10-12 |
| CVE-2020-25175GE Healthcare Imaging and Ultrasound Products may allow specific credentials to be exposed during transport over the network.Gehealthcare · GE Healthcare Imaging and Ultrasound Products · 2020-12-14 | – | 1.1% | 2020-12-14 |
| CVE-2022-31805Insecure transmission of credentialsCODESYS · CODESYS Development System · CVSS 7.5 · 2022-06-24 | 7.5 | 1.1% | 2022-06-24 |
| CVE-2024-1102Jberet: jberet-core logging database credentialsRed Hat · Red Hat JBoss Enterprise Application Platform 7.4.16 · CVSS 6.5 · 2024-04-25 | 6.5 | 0.8% | 2024-04-25 |
| CVE-2017-16731An Unprotected Transport of Credentials issue was discovered in ABB Ellipse 8.3 through Ellipse 8.9 released prior to December 2017 (including Ellipse Select). A vulnerability exi…Hitachienergy · ABB Ellipse · 2017-12-20 | – | 0.7% | 2017-12-20 |
| CVE-2023-22862IBM Aspera information disclosureIBM · Aspera Connect · CVSS 5.9 · 2023-06-04 | 5.9 | 0.6% | 2023-06-04 |
| CVE-2023-31277PiiGAB M-Bus Unprotected Transport of CredentialsPiiGAB · M-Bus SoftwarePack · CVSS 7.5 · 2023-07-06 | 7.5 | 0.6% | 2023-07-06 |
| CVE-2025-57800Audiobookshelf vulnerable to OIDC token exfiltration and account takeoveradvplyr · audiobookshelf · CVSS 8.8 · 2025-08-22 | 8.8 | 0.5% | 2025-08-22 |
| CVE-2025-41705Phoenix Contact: WebSocket Message Interception Leaks Webfrontend CredentialsPhoenix Contact · QUINT4-UPS/24DC/24DC/5/EIP · CVSS 6.8 · 2025-10-14 | 6.8 | 0.5% | 2025-10-14 |
| CVE-2024-1509Brocade ASCG 3.2.0 web interface does not enforce HSTS, as defined by RFC 6797 for ports 8030 and 8100Brocade · ASCG · CVSS 7.6 · 2025-02-28 | 7.6 | 0.4% | 2025-02-28 |
| CVE-2026-113866Account password sent unencrypted during Exchange account setupMozilla · Thunderbird · CVSS 5.9 · 2026-10-20 | 5.9 | 0.4% | 2026-10-20 |
| CVE-2026-23635Kiteworks Secure Data Forms has a potential Unprotected Transport of Credentialskiteworks · Secure Data Forms · CVSS 6.5 · 2026-03-25 | 6.5 | 0.3% | 2026-03-25 |
| CVE-2025-61121Mobile Scanner Android App version 2.12.38 (package name com.glority.everlens), developed by Glority Global Group Ltd., contains a credential leakage vulnerability. Improper handl…No vendor recorded · CVSS 7.5 · 2025-10-30 | 7.5 | 0.3% | 2025-10-30 |
| CVE-2026-8668Hardcoded credentials in embedded contentProgress Chef · Chef360 · CVSS 2.3 · 2026-06-18 | 2.3 | 0.3% | 2026-06-18 |
| CVE-2026-56587HCL IEM was affected with Strict transport security not enforcedHCLSoftware · IntelliOps Event Management · CVSS 3.7 · 2026-07-21 | 3.7 | 0.2% | 2026-07-21 |
| CVE-2025-64308Brightpick Mission Control / Internal Logic Control Unprotected Transport of CredentialsBrightpick AI · Brightpick Mission Control / Internal Logic Control · CVSS 6.5 · 2025-11-14 | 6.5 | 0.2% | 2025-11-14 |
| CVE-2021-32003Configuration service port remains open 10 minutes after reboot even when already provisionedSecomea · SiteManager · CVSS 8 · 2021-08-05 | 8.0 | 0.2% | 2021-08-05 |
| CVE-2025-64309Brightpick Mission Control / Internal Logic Control Unprotected Transport of CredentialsBrightpick AI · Brightpick Mission Control / Internal Logic Control · CVSS 7.4 · 2025-11-14 | 7.4 | 0.2% | 2025-11-14 |
| CVE-2024-20395A vulnerability in the media retrieval functionality of Cisco Webex App could allow an unauthenticated, adjacent attacker to gain access to sensitive session information. This vul…Cisco · Cisco Webex Teams · CVSS 6.4 · 2024-07-17 | 6.4 | 0.2% | 2024-07-17 |
| CVE-2026-17620IBM Financial Transaction Manager (FTM) is Impacted by Multiple VulnerabilitiesIBM · Financial Transaction Manager (FTM) for RedHat OpenShift · CVSS 5.3 · 2026-09-22 | 5.3 | 0.2% | 2026-09-22 |
| CVE-2025-66029Open OnDemand affected by Apache proxy passing sensitive headersOSC · ondemand · CVSS 7.6 · 2025-12-17 | 7.6 | 0.2% | 2025-12-17 |
| CVE-2026-8673Password re-initialization mechanism sends passwords in plain textsyslink software AG · Avantra · CVSS 5.9 · 2026-05-22 | 5.9 | 0.2% | 2026-05-22 |
| CVE-2025-61916Spinnaker vulnerable to SSRF due to improper restrictions on http from user inputspinnaker · spinnaker · CVSS 7.9 · 2026-01-05 | 7.9 | 0.2% | 2026-01-05 |
| CVE-2024-4188Security vulnerability exists in Documentum server cloud releases that could allow access to sensitive information which can impact system Operation.OpenText™ · Documentum™ Server · CVSS 7.1 · 2024-07-30 | 7.1 | 0.2% | 2024-07-30 |
EPSS is the probability of exploitation in the next 30 days (FIRST). Data as of 2026-11-14.