Skip to content

CWE-255: Credentials Management Errors

Weaknesses in this category are related to the management of credentials.

From the CWE List. © The MITRE Corporation.

Newest

mailenable netwebadmin professional, netwebadmin enterprise +1 morewebadmin in MailEnable NetWebAdmin Professional 2.32 and Enterprise 2.32 allows remote attackers...CVE-2006-62397.5 HighDecember 3, 2006
pswd.jsThe pswd.js script relies on the client to calculate whether a username and password match hard...CVE-2006-4068Public exploit5.0 MediumAugust 10, 2006
vmware esxVMware ESX Server 2.0.x before 2.0.2 and 2.x before 2.5.2 patch 4 stores authentication...CVE-2006-2481Public exploit5.0 MediumJuly 31, 2006
ultimate php board php boardThe installation of Ultimate PHP Board (UPB) 1.9.6 and earlier includes a default administrator...CVE-2006-320310.0 HighJune 24, 2006
netgear wgt624NETGEAR WGT624 Wireless DSL router has a default account of super_username "Gearguy" and...CVE-2006-100210.0 HighMarch 6, 2006
xwikiThe search functionality in XWiki 0.9.793 indexes cleartext user passwords, which allows remote...CVE-2005-48625.0 MediumDecember 31, 2005
openbsd opensshSSH, as implemented in OpenSSH before 4.0 and possibly other implementations, stores hostnames,...CVE-2005-2666Fix available1.2 LowAugust 23, 2005
nessus nessuswxNessusWX 1.4.4 stores account passwords in plaintext in .session files, which allows local users...CVE-2004-27232.1 LowDecember 31, 2004
nessus** DISPUTED ** Nessus 2.0.10a stores account passwords in plaintext in .nessusrc files, which...CVE-2004-2722Disputed2.1 LowDecember 31, 2004
phrozensmoke gyach enhancedGyach Enhanced (Gyach-E) before 1.0.0 stores passwords in plaintext, which allows attackers to...CVE-2004-27085.0 MediumDecember 31, 2004
bea weblogic serverBEA WebLogic Server and WebLogic Express 6.1, 7.0, and 8.1, when using Remote Method Invocation ...CVE-2004-26965.5 MediumDecember 31, 2004
solarwinds serv-u file serverServ-U FTP server before 5.1.0.0 has a default account and password for local administration,...CVE-2004-2532Public exploitEPSS 15.3%10.0 HighDecember 31, 2004
oracle application server, collaboration suite, e-business suite +6 more +8 moreOracle 10g Database Server stores the password for the SYSMAN account in cleartext in the world...CVE-2004-1366EPSS 15.5%4.6 MediumAugust 4, 2004
flashfxpFlashFXP 1.4 uses a weak encryption algorithm for user passwords, which allows attackers to...CVE-2003-14836.4 MediumDecember 31, 2003
microsoft mn-500 wireless base stationThe backup configuration file for Microsoft MN-500 wireless base station stores administrative...CVE-2003-14824.6 MediumDecember 31, 2003
silc secure internet live conferencingSecure Internet Live Conferencing (SILC) 0.9.11 and 0.9.12 stores passwords and sessions in...CVE-2003-14394.3 MediumDecember 31, 2003
petitforummessage.php in Petitforum does not properly authenticate users, which allows remote attackers to...CVE-2003-14246.8 MediumDecember 31, 2003
ncipher support softwarenCipher Support Software 6.00, when using generatekey KeySafe to import keys, does not delete the...CVE-2003-14174.4 MediumDecember 31, 2003
php board boardlogin.php in php-Board 1.0 stores plaintext passwords in $username.txt with insufficient access...CVE-2003-1401Public exploit5.8 MediumDecember 31, 2003
coffeecup software password wizardCoffeeCup Software Password Wizard 4.0 stores sensitive information such as usernames and...CVE-2003-13945.0 MediumDecember 31, 2003
winzipWinZip 8.0 uses weak random number generation for password protected ZIP files, which allows...CVE-2003-13764.6 MediumDecember 31, 2003
haxx curlcurl 7.x before 7.10.7 sends CONNECT proxy credentials to the remote server.CVE-2003-1605Fix available7.5 HighAugust 3, 2003
nullsoft winampWinamp 2.80 stores authentication credentials in plaintext in the (1) [HTTP-AUTH] and (2) [winamp...CVE-2002-24122.1 LowDecember 31, 2002
fastlink software the serverTheServer 1.74 web server stores server.ini under the web document root with insufficient access...CVE-2002-23895.0 MediumDecember 31, 2002
hotfoon corporation hotfoonhotfoon4.exe in Hotfoon 4.00 stores user names and passwords in cleartext in the hotfoon2...CVE-2002-23843.6 LowDecember 31, 2002
netgear fm114pNetgear FM114P firmware 1.3 wireless firewall, when configured to backup configuration...CVE-2002-23557.1 HighDecember 31, 2002
oracle application serverOracle 9i Application Server 9.0.2 stores the web cache administrator interface password in...CVE-2002-23457.5 HighDecember 31, 2002
kryptronic clickcartproClickCartPro 4.0 stores the admin_user.db data file under the web document root with insufficient...CVE-2002-23105.0 MediumDecember 31, 2002
lawson software financialsLawson Financials 8.0, when configured to use a third party relational database, stores usernames...CVE-2002-23013.3 LowDecember 31, 2002
mambo site serverMambo Site Server 4.0.11 installs with a default username and password of admin, which allows...CVE-2002-229010.0 HighDecember 31, 2002
microsoft windows ntWindows NT with SYSKEY reuses the keystream that is used for encrypting SAM password hashes,...CVE-1999-09945.0 MediumDecember 16, 1999
microsoft windows 95, windows 98 +1 moreA legacy credential caching mechanism used in Windows 95 and Windows 98 systems allows attackers...CVE-1999-03877.8 HighNovember 29, 1999
microsoft windows nt, windows 2000 +1 moreWindows NT RRAS and RAS clients cache a user's password even if the user has not selected the ...CVE-1999-0755Public exploitEPSS 15.0%5.0 MediumMay 27, 1999
bsd, freebsd, netbsd +2 more +4 moreThe asynchronous I/O facility in 4.4 BSD kernel does not check user credentials when setting the...CVE-1999-12142.1 LowSeptember 15, 1997