CWE-522

CVE-2022-23223

February 23, 2023 by

The HTTP response will disclose the user password. This issue affected Apache ShenYu 2.4.0 and 2.4.1.

CVE-2022-23109

February 23, 2023 by

Jenkins HashiCorp Vault Plugin 3.7.0 and earlier does not mask Vault credentials in Pipeline build logs or in Pipeline step descriptions when Pipeline: Groovy Plugin 2.85 or later is installed.

Jenkins Publish Over SSH Plugin 1.22 and earlier stores password unencrypted in its global configuration file on the Jenkins controller where it can be viewed by users with access to the Jenkins controller file system.

CVE-2022-22983

February 23, 2023 by

VMware Workstation (16.x prior to 16.2.4) contains an unprotected storage of credentials vulnerability. A malicious actor with local user privileges to the victim machine may exploit this vulnerability leading to the disclosure of user passwords of the remote server connected through VMware Workstation.

CVE-2022-22998

February 23, 2023 by

Implemented protections on AWS credentials that were not properly protected.

CVE-2022-22908

February 23, 2023 by

SangforCSClient.exe in Sangfor VDI Client 5.4.2.1006 allows attackers, when they are able to read process memory, to discover the contents of the Username and Password fields.