CWE-255: Credentials Management Errors
Weaknesses in this category are related to the management of credentials.
From the CWE List. © The MITRE Corporation.
Newest
- lenovo thinkvantage system updateThe client in Lenovo System Update before 3.14 does not properly validate the certificate when...5.1 Medium
- ibm websphere application serverUnspecified vulnerability in the PropFilePasswordEncoder utility in the Security component in IBM...10.0 High
- suse opensusesudo in SUSE openSUSE 10.3 does not clear the stdin buffer when password entry times out, which...2.1 Low
- netscape certificate management systemRed Hat PKI Common Framework (rhpki-common) in Red Hat Certificate System (aka Certificate Server...7.5 High
- alstrasoft askmeAlstraSoft AskMe Pro 2.1 and earlier stores passwords in cleartext in a MySQL database, which...5.0 Medium
- cisco service control engine, icon-labs iconfidant ssh +1 moreUnspecified vulnerability in the SSH server in (1) Cisco Service Control Engine (SCE) before 3.1...7.8 High
- symantec altiris deployment solutionaxengine.exe in Symantec Altiris Deployment Solution 6.8.x and 6.9.x before 6.9.176 generates...7.5 High
- freelance auction scriptFreelance Auction Script 1.0 stores user passwords in plaintext in the tbl_users table, which...5.0 Medium
- firebirdThe default configuration of Firebird before 2.0.3.12981.0-r6 on Gentoo Linux sets the...5.0 Medium
- mucommandermuCommander before 0.8.2 stores credentials.xml with insecure permissions, which allows local...2.1 Low
- airspan prost web managementThe Advanced User Interface Pages in the ProST Web Management component on the Airspan WiMAX...7.5 High
- airspan base station distribution unitAirspan Base Station Distribution Unit (BSDU) has "topsecret" as its password for the root...7.5 High
- zyxel prestige 660, prestige 661, zynos +2 moreZyXEL Prestige routers have a minimum password length for the admin account that is too small,...5.0 Medium
- asterisk, asterisk appliance developer kit, business edition +2 more +4 moreThe AsteriskGUI HTTP server in Asterisk Open Source 1.4.x before 1.4.19-rc3 and 1.6.x before 1.6...9.3 High
- plone cmsPlone credentials stored in session cookie4.3 Medium
- plone cmsPlone CMS Improper Session Management7.5 High
- plone cmsPlone Improper Session Management10.0 High
- apple mac os x, mac os x server +1 moreThe Printing component in Apple Mac OS X 10.5.2 might save authentication credentials to disk...1.7 Low
- dovecotArgument injection vulnerability in Dovecot 1.0.x before 1.0.13, and 1.1.x before 1.1.rc3, when...6.8 Medium
- dnssec-toolsThe DNSSEC validation library (libval) library in dnssec-tools before 1.3.1 does not properly...5.0 Medium
- bea weblogic serverBEA WebLogic Server and Express 7.0 through 10.0 allows remote attackers to conduct brute force...7.1 High
- the everything development company everything development engineThe Everything Development Engine in The Everything Development System Pre-1.0 and earlier stores...5.0 Medium
- xlight ftp server ftp serverThe LDAP authentication feature in XLight FTP Server before 2.83, when used with some unspecified...6.8 Medium
- moernaut lsrunase, supercrypt +1 moreGeert Moernaut LSrunasE 1.0 and Supercrypt 1.0 use the RC4 stream cipher without constructing a...2.1 Low
- alstrasoft forum pay per post exchangeAlstraSoft Forum Pay Per Post Exchange 2.0 stores passwords in cleartext, which makes it easier...5.0 Medium
- cisco application velocity systemCisco Application Velocity System (AVS) before 5.1.0 is installed with default passwords for some...10.0 High
- 2z project project2z project 0.9.6.1 allows attackers to change the password without supplying the old password.6.4 Medium
- adultscriptadmin/administrator.php in Adult Script 1.6 and earlier sends a redirect to the web browser but...7.5 High
- myupb flat php boardindex.php in Flat PHP Board 1.2 and earlier allows remote authenticated users to obtain the...6.5 Medium
- microsoft officeMicrosoft Office 2007 12.0.6015.5000 and MSO 12.0.6017.5000 do not sign the metadata of Office...6.4 Medium
- citrix edgesight for netscaler, edgesight for endpoints, edgesight for presentation server +2 moreCitrix EdgeSight 4.2 and 4.5 for Presentation Server, EdgeSight 4.2 and 4.5 for Endpoints, and...2.1 Low
- oracle database serverThe installation process for Oracle 10g and llg uses accounts with default passwords, which...6.8 Medium
- ingate firewall, siparator +1 moreIngate Firewall before 4.6.0 and SIParator before 4.6.0 use cleartext storage for passwords of ...5.0 Medium
- adobe coldfusionAdobe ColdFusion 8 and MX 7 allows remote attackers to hijack sessions via unspecified vectors...6.8 Medium
- bti-trackerblocks/shoutbox_block.php in BtiTracker 1.4.4 does not verify user accounts, which allows remote...7.5 High
- redhat certificate serverCertificate Server 7.2 in Red Hat Certificate System (RHCS) does not properly handle new...7.5 High
- pligg cmslogin.php in Pligg CMS 9.5 uses a guessable confirmation code when resetting a forgotten password...7.5 High
- adam scheinberg flipAdam Scheinberg Flip 3.0 and earlier stores sensitive information under the web root with...5.0 Medium
- linden lab second lifeArgument injection vulnerability in the Linden Lab Second Life secondlife:// protocol handler, as...5.0 Medium
- backup manager managerbackup-manager-upload in Backup Manager before 0.6.3 provides the FTP server hostname, username,...2.1 Low
- ibm surepos 500IBM SurePOS 500 has (1) a default password of "12345" for the manager and (2) blank default...4.6 Medium
- entrust entelligence security providerEntrust Entelligence Security Provider (ESP) 8 does not properly validate certificates in certain...6.4 Medium
- netiq identity manager, novell client login extension \(cle\) +1 moreThe Client Login Extension (CLE) in Novell Identity Manager before 3.5.1 20070730 stores the...2.1 Low
- ez photo sales photo salesEZPhotoSales 1.9.3 and earlier stores sensitive information under the web root with insufficient...7.5 High
- bwiredSession fixation vulnerability in bwired allows remote attackers to hijack web sessions by...4.3 Medium
- mailwasher serverMailWasher Server before 2.2.1, when used with LDAP or Active Directory (AD), does not properly...7.1 High
- cactusoft cactushopCactushop 6 and earlier stores sensitive information under the web root with insufficient access...7.8 High
- backup manager managerlib/backup-methods.sh in Backup Manager before 0.7.6 provides the MySQL password as a plaintext...7.2 High
- cisco secure services client, security agent, trust agent +1 more +3 moreThe (1) TTLS CHAP, (2) TTLS MSCHAP, (3) TTLS MSCHAPv2, (4) TTLS PAP, (5) MD5, (6) GTC, (7) LEAP, ...7.2 High
- cisco network admission control manager and server system softwareCisco Clean Access (CCA) 3.6.x through 3.6.4.2 and 4.0.x through 4.0.3.2 does not properly...10.0 High
- Show moreLoading…