CWE-255: Credentials Management Errors
Weaknesses in this category are related to the management of credentials.
From the CWE List. © The MITRE Corporation.
Newest
- andrew j.korty pam sshpam_ssh 1.92 and possibly other versions, as used when PAM is compiled with USE=ssh, generates...5.0 Medium
- aztech adsl2\/2\+4-port routerAztech ADSL2/2+ 4-port router has a default "isp" account with a default "isp" password, which...10.0 High
- nortel cs1000Nortel MG1000S, Signaling Server, and Call Server on the Communications Server 1000 (CS1K) 4.50.x...10.0 High
- cale dunlap openinvoiceresetpass.php in openInvoice 0.90 beta and earlier allows remote authenticated users to change...6.5 Medium
- sun java system identity managerSun Java System Identity Manager (IdM) 7.0 through 8.0 responds differently to failed use of the...5.0 Medium
- apachefriends xamppXAMPP installs multiple packages with insecure default passwords, which makes it easier for...7.5 High
- blogator-script_blogadata/include/init_pass2.php in Blogator-script 0.95 allows remote attackers to change the...6.4 Medium
- cisco unified communications managerThe IP Phone Personal Address Book (PAB) Synchronizer feature in Cisco Unified Communications...9.0 High
- cisco application control engine moduleCisco ACE Application Control Engine Module for Catalyst 6500 Switches and 7600 Routers before A2...10.0 High
- cisco application networking managerCisco Application Networking Manager (ANM) before 2.0 uses a default MySQL root password, which...10.0 High
- cisco application networking managerCisco Application Networking Manager (ANM) before 2.0 uses default usernames and passwords, which...10.0 High
- preprojects pre shopping mallPre Shopping Mall allows remote attackers to bypass authentication and gain administrative access...7.5 High
- preprojects pre classified listingsPre Classified Listing PHP allows remote attackers to bypass authentication and gain...7.5 High
- preproject pre multi-vendor shopping mallsPre Multi-Vendor Shopping Malls allows remote attackers to bypass authentication and gain...7.5 High
- toshiba face recognitionToshiba Face Recognition 2.0.2.32 allows physically proximate attackers to obtain notebook access...6.9 Medium
- asus smartlogonAsus SmartLogon 1.0.0005 allows physically proximate attackers to bypass "security functions" by...6.9 Medium
- intrinsic swimage encoreConductor.exe in Intrinsic Swimage Encore before 5.0.1.21 contains a hardcoded password, which...2.1 Low
- swannsecurity dvr4-securanetThe HTTP interface in Swann DVR4-SecuraNet has a certain default administrative username and...5.0 Medium
- ibm websphere message brokerIBM WebSphere Message Broker 6.1.x before 6.1.0.2 writes a database connection password to the...2.1 Low
- ge fanuc ifixGE Fanuc iFIX 5.0 and earlier relies on client-side authentication involving a weakly encrypted...10.0 High
- apple mac os x, mac os x server +1 moreUnspecified vulnerability in fseventsd in the FSEvents framework in Apple Mac OS X 10.5.6 allows...4.9 Medium
- apple mac os x, mac os x server +1 moredscl in DS Tools in Apple Mac OS X 10.4.11 and 10.5.6 requires that passwords must be provided as...2.1 Low
- redhat certificate systemRed Hat Certificate System 7.2 stores passwords in cleartext in the UserDirEnrollment log, the RA...2.1 Low
- sun java system access managerSun Java System Access Manager 6.3 2005Q1, 7 2005Q4, and 7.1 allows remote authenticated users...6.0 Medium
- cisco ironport encryption appliance, ironport postx +1 morePXE Encryption in Cisco IronPort Encryption Appliance 6.2.4 before 6.2.4.1.1, 6.2.5, 6.2.6, 6.2.7...4.3 Medium
- nortel multimedia communication server 5100Nortel Multimedia Communication Server (MSC) 5100 3.0.13 does not verify credentials during call...6.4 Medium
- advantech adam-6015, adam-6017, adam-6018 +11 more +13 moreThe Advantech ADAM-6000 module has 00000000 as its default password, which makes it easier for...10.0 High
- constructr constructr-cmsConstructr CMS 3.02.5 and earlier stores passwords in cleartext in a MySQL database, which allows...2.6 Low
- novell netwareNovell NetWare 6.5 before Support Pack 8, when an OES2 Linux server is installed into the NDS...9.3 High
- sun opensolaris, solaris +1 moreThe Kerberos credential renewal feature in Sun Solaris 8, 9, and 10, and OpenSolaris build snv_01...2.1 Low
- textpatternTextpattern (aka Txp CMS) 4.0.5 does not ask for the old password during a password reset, which...6.8 Medium
- microsoft windows media format runtime, windows media player, windows media services +2 moreMicrosoft Windows Media Player 6.4, Windows Media Format Runtime 7.1 through 11, and Windows...10.0 High
- ibm rational clearquestThe ClearQuest Maintenance Tool in IBM Rational ClearQuest 7 before 7.1 stores the database...6.5 Medium
- ibm rational clearquestThe ClearQuest Maintenance Tool in IBM Rational ClearQuest 7.0.0 before 7.0.0.4 and 7.0.1 before...4.4 Medium
- octeth oempromember/settings_account.php in Octeth Oempro 3.5.5.1, and possibly other versions before 4, uses...4.0 Medium
- ecryptfs utilsThe (1) ecryptfs-setup-private, (2) ecryptfs-setup-confidential, and (3) ecryptfs-setup-pam...7.2 High
- apple cupsThe web interface (cgi-bin/admin.c) in CUPS before 1.3.8 uses the guest username when a user is...10.0 High
- dcgrendel vmbuilderUbuntu 6.06 LTS, 7.10, 8.04 LTS, and 8.10, when installed as a virtual machine by (1) python-vm...7.2 High
- dcgrendel vmbuilderThe (1) python-vm-builder and (2) ubuntu-vm-builder implementations in VMBuilder 0.9 in Ubuntu 8...7.2 High
- philips electronics voip841 dect phoneThe web component in Philips Electronics VOIP841 DECT Phone with firmware 1.0.4.50 and 1.0.4.80...5.0 Medium
- ibm lotus connectionsIBM Lotus Connections 2.x before 2.0.1 stores the password for the administrative user in the...2.1 Low
- vim netrwautoload/netrw.vim (aka the Netrw Plugin) 109, 131, and other versions before 133k for Vim 7.1...4.3 Medium
- websense enterpiseThe Websense Reporter Module in Websense Enterprise 6.3.2 stores the SQL database system...2.1 Low
- microsoft windows mobileWindows Mobile 6 on the HTC Hermes device makes WLAN passwords available to an auto-completion...2.1 Low
- cisco linksys wrt350nThe Cisco Linksys WRT350N with firmware 1.0.3.7 has "admin" as its default password for the ...10.0 High
- opera browserOpera before 9.52 does not check the CRL override upon encountering a certificate that lacks a...10.0 High
- apple mac os x, mac os x server +1 moreRemote Management and Screen Sharing in Apple Mac OS X 10.5 through 10.5.4, when used to set a...5.0 Medium
- apple mac os x, mac os x server +1 moreNetwork Preferences in Apple Mac OS X 10.4.11 stores PPP passwords in cleartext in a world...4.9 Medium
- davlin thickbox galleryDavlin Thickbox Gallery 2 allows remote attackers to obtain the administrative username and MD5...5.0 Medium
- craftysyntax crafty syntax live helpCrafty Syntax Live Help (CSLH) 2.14.6 and earlier stores passwords in cleartext in a MySQL...5.0 Medium
- Show moreLoading…