1229
Reference Description
CVE-2022-29959 Initialization file contains credentials that can be decoded using a "simple
string transformation"
https://www.cve.org/CVERecord?id=CVE-2022-29959
CVE-2022-35411 Python-based RPC framework enables pickle functionality by default, allowing
clients to unpickle untrusted data.
https://www.cve.org/CVERecord?id=CVE-2022-35411
CVE-2022-29519 Programmable Logic Controller (PLC) sends sensitive information in plaintext,
including passwords and session tokens.
https://www.cve.org/CVERecord?id=CVE-2022-29519
CVE-2022-30312 Building Controller uses a protocol that transmits authentication credentials in
plaintext.
https://www.cve.org/CVERecord?id=CVE-2022-30312
CVE-2022-31204 Programmable Logic Controller (PLC) sends password in plaintext.
https://www.cve.org/CVERecord?id=CVE-2022-31204
CVE-2022-30275 Remote Terminal Unit (RTU) uses a driver that relies on a password stored in
plaintext.
https://www.cve.org/CVERecord?id=CVE-2022-30275
CVE-2007-0681 Web app allows remote attackers to change the passwords of arbitrary
users without providing the original password, and possibly perform other
unauthorized actions.
https://www.cve.org/CVERecord?id=CVE-2007-0681
CVE-2000-0944 Web application password change utility doesn't check the original password.
https://www.cve.org/CVERecord?id=CVE-2000-0944
CVE-2005-3435 product authentication succeeds if user-provided MD5 hash matches the hash
in its database; this can be subjected to replay attacks.
https://www.cve.org/CVERecord?id=CVE-2005-3435
CVE-2005-0408 chain: product generates predictable MD5 hashes using a constant value
combined with username, allowing authentication bypass.
https://www.cve.org/CVERecord?id=CVE-2005-0408
MemberOf Relationships
This MemberOf relationships table shows additional CWE Catgeories and Views that reference this
weakness as a member. This information is often useful in understanding where a weakness fits
within the context of external information sources.
Nature Type ID Name Page
MemberOf 718 OWASP Top Ten 2007 Category A7 - Broken
Authentication and Session Management
629 2332
MemberOf 724 OWASP Top Ten 2004 Category A3 - Broken
Authentication and Session Management
711 2335
MemberOf 884 CWE Cross-section 884 2567
MemberOf 930 OWASP Top Ten 2013 Category A2 - Broken
Authentication and Session Management
928 2389
MemberOf 963 SFP Secondary Cluster: Exposed Data 888 2400
MemberOf 1028 OWASP Top Ten 2017 Category A2 - Broken
Authentication
1026 2436
MemberOf 1337 Weaknesses in the 2021 CWE Top 25 Most Dangerous
Software Weaknesses
1337 2589
MemberOf 1348 OWASP Top Ten 2021 Category A04:2021 - Insecure
Design
1344 2491
MemberOf 1350 Weaknesses in the 2020 CWE Top 25 Most Dangerous
Software Weaknesses
1350 2594
MemberOf 1396 Comprehensive Categorization: Access Control 1400 2519
CWE Version 4.14
CWE-523: Unprotected Transport of Credentials
CWE-523: Unprotected Transport of Credentials