CWE-549 - Missing Password Field Masking

Home/CWEs/CWE info/

CWE-549

Abstraction:
Base

Structure:
Simple

Status:
Draft

Weakness Name: Missing Password Field Masking

Description: The product does not mask passwords during entry, increasing the potential for attackers to observe and capture passwords.

Common Consequences: Scope: Access Control
Impact: Bypass Protection Mechanism

Related Weaknesses: CWE-522Insufficiently Protected Credentials

Release Date:
2006-07-19

Latest Modification Date:
2023-06-29

Top Security News

Hackers now use AppDomain Injection to drop CobaltStrike beacons

New Ymir Ransomware Exploits Memory for Stealthy Attacks; Targets Corporate Networks

Attackers are exploiting 2 zero-days in Palo Alto Networks firewalls (CVE-2024-0012, CVE-2024-9474)

Urgent: Critical WordPress Plugin Vulnerability Exposes Over 4 Million Sites

Privileged Accounts, Hidden Threats: Why Privileged Access Security Must Be a Top Priority

CWE top 25 most dangerous software weaknesses

PAN-OS Firewall Vulnerability Under Active Exploitation – IoCs Released

China-Backed Hackers Leverage SIGTRAN, GSM Protocols to Infiltrate Telecom Networks

Common Alerts

HighServer Side Code Injection - ASP Code Injection

InformationalSec-Fetch-User Header Has an Invalid Value

LowInformation Disclosure - Sensitive Information in Browser localStorage

HighCross Site Scripting (Reflected)

HighLog4Shell (CVE-2021-44228)

InformationalUsername Hash Found

InformationalNon-Storable Content

HighPath Traversal

HighXPath Injection

HighSource Code Disclosure - File Inclusion

Latest CVE List

CVE-2024-44308 Apple Multiple Products Code Execution Vulnerability

CVE-2024-44309 Apple Multiple Products Cross-Site Scripting (XSS) Vulnerability

CVE-2024-21287 Oracle Agile Product Lifecycle Management (PLM) Incorrect Authorization Vulnerability

CVE-2024-38812 VMware vCenter Server Heap-Based Buffer Overflow Vulnerability

CVE-2024-38813 VMware vCenter Server Privilege Escalation Vulnerability

CVE-2024-1212 Progress Kemp LoadMaster OS Command Injection Vulnerability

CVE-2024-0012 Palo Alto Networks PAN-OS Management Interface Authentication Bypass Vulnerability

CVE-2024-9474 Palo Alto Networks PAN-OS Management Interface OS Command Injection Vulnerability

CVE-2024-9463 Palo Alto Networks Expedition OS Command Injection Vulnerability

CVE-2024-9465 Palo Alto Networks Expedition SQL Injection Vulnerability

Top CWE List

CWE-1245 Improper Finite State Machines (FSMs) in Hardware Logic

CWE-1072 Data Resource Access without Use of Connection Pooling

CWE-1091 Use of Object without Invoking Destructor Method

CWE-1174 ASP.NET Misconfiguration: Improper Model Validation

CWE-1191 On-Chip Debug and Test Interface With Improper Access Control

LowCWE-262 Not Using Password Aging

HighCWE-416 Use After Free

HighCWE-639 Authorization Bypass Through User-Controlled Key

Free security scan for your website

Don't show website scan report rating on the leaderboard

CWE-549 - Missing Password Field Masking

The product does not mask passwords during entry, increasing the potential for attackers to observe and capture passwords.