CWE-255: Credentials Management Errors
Weaknesses in this category are related to the management of credentials.
From the CWE List. © The MITRE Corporation.
Newest
- cisco digital media managerCisco Digital Media Manager (DMM) 5.0.x and 5.1.x has a default password for the Tomcat...10.0 High
- mole-group bus ticket script, sky hunter airline ticket sale script +1 moreadmin/admin.php in Mole Group Sky Hunter Airline Ticket Sale Script and Bus Ticket Script allows...7.5 High
- google chromebrowser/login/login_prompt.cc in Google Chrome before 4.0.249.89 populates an authentication...4.3 Medium
- myshell evalsmsievalSMSI 2.1.03 stores passwords in cleartext in the database, which allows attackers with...7.5 High
- hp operations agentHP Operations Agent 8.51, 8.52, 8.53, and 8.60 on Solaris 10 uses a blank password for the opc_op...10.0 High
- sun clusterSun Cluster 2.2, when HA-Oracle or HA-Sybase DBMS services are used, stores database credentials...1.9 Low
- ibm cognos expressIBM Cognos Express 9.0 allows attackers to obtain unspecified access to the Tomcat Manager...7.5 High
- symantec altiris notification serverThe web console in Symantec Altiris Notification Server 6.0.x before 6.0 SP3 R12 uses a hardcoded...4.3 Medium
- cisco unified meetingplaceMeetingTime in Cisco Unified MeetingPlace 6 before MR5, and possibly 5, allows remote attackers...6.4 Medium
- gnu glibcnis/nss_nis/nis-pwd.c in the GNU C Library (aka glibc or libc6) 2.7 and Embedded GLIBC (EGLIBC) 2...7.5 High
- verbatim corporate secureVerbatim Corporate Secure and Corporate Secure FIPS Edition USB flash drives do not prevent...4.6 Medium
- verbatim corporate secureVerbatim Corporate Secure and Corporate Secure FIPS Edition USB flash drives validate passwords...4.6 Medium
- sandisk cruzer enterprise usbSanDisk Cruzer Enterprise USB flash drives do not prevent password replay attacks, which allows...4.6 Medium
- sandisk cruzer enterprise usbSanDisk Cruzer Enterprise USB flash drives validate passwords with a program running on the host...4.6 Medium
- intellicom netbiter webscada firmware, netbiter webscada ws100, netbiter webscada ws200 +2 moreIntellicom NetBiter WebSCADA devices use default passwords for the HICP network configuration...10.0 High
- transware active\! mailTransWARE Active! mail 2003 build 2003.0139.0871 and earlier does not properly secure the session...5.8 Medium
- moodleMoodle 1.8 before 1.8.11 and 1.9 before 1.9.7 does not use a random password salt in config.php,...7.5 High
- microsoft windows 2000, windows server 2003, windows server 2008 +2 more +4 moreThe Internet Authentication Service (IAS) in Microsoft Windows 2000 SP4, XP SP2 and SP3, Server...10.0 High
- microsoft windows server 2003, windows server 2008 +1 moreThe single sign-on implementation in Active Directory Federation Services (ADFS) in Microsoft...6.9 Medium
- hp operations managerHP Operations Manager has a default password of OvW*busr1 for the ovwebusr account, which allows...10.0 High
- hp operations dashboardHP Operations Dashboard has a default password of j2deployer for the j2deployer account, which...10.0 High
- scriptlerim radio isetek scriptiRADIO istek scripti 2.5 stores sensitive information under the web root with insufficient access...7.5 High
- apache tomcatThe Windows installer for Apache Tomcat 6.0.0 through 6.0.20, 5.5.0 through 5.5.28, and possibly...7.5 High
- apple mac os x serverEvent Monitor in Apple Mac OS X 10.5.8 does not properly handle crafted authentication data sent...5.0 Medium
- riorey riosRioRey RIOS 4.6.6 and 4.7.0 uses an undocumented, hard-coded username (dbadmin) and password (sq...10.0 High
- ibm aixgssd in IBM AIX 5.3.x through 5.3.9 and 6.1.0 through 6.1.2 does not properly handle the NFSv4...7.2 High
- mozilla bugzillatoken.cgi in Bugzilla 3.4rc1 through 3.4.1 places a password in a URL at the beginning of a login...5.0 Medium
- stanford webauthweblogin/login.fcgi (aka the WebLogin login script) in Stanford University WebAuth 3.5.5, 3.6.0,...4.3 Medium
- anantasoft gazelle cmsAnantasoft Gazelle CMS 1.0 allows remote attackers to conduct a password reset for other users...7.5 High
- wowraidmanagerThe password_check function in auth/auth_phpbb3.php in WoW Raid Manager 3.5.1 before Patch 1,...7.5 High
- ibm websphere application serverThe Web Services functionality in IBM WebSphere Application Server (WAS) 6.1 before 6.1.0.25 and...2.1 Low
- wordpresswp-login.php in WordPress 2.8.3 and earlier allows remote attackers to force a password reset for...7.5 High
- simplemachines smfThe password reset functionality in Simple Machines Forum (SMF) 1.0.x before 1.0.14, 1.1.x before...7.5 High
- microsoft windows 2000, windows 2003 server, windows server 2008 +2 more +4 moreThe Telnet service in Microsoft Windows 2000 SP4, XP SP2 and SP3, Server 2003 SP2, Vista Gold,...10.0 High
- apple mac os x, mac os x server +1 moreMobileMe in Apple Mac OS X 10.5 before 10.5.8 does not properly delete credentials upon signout...7.5 High
- ibm lotus instant messaging and web conferencingThe Sametime server in IBM Lotus Instant Messaging and Web Conferencing 6.5.1 generates error...5.0 Medium
- mcafee smartfilterSmartFilter Web Gateway Security 4.2.1.00 stores user credentials in cleartext in admin_backup...4.6 Medium
- gizmo5 gizmoGizmo 3.1.0.79 on Linux does not verify a server's SSL certificate, which allows remote servers...5.0 Medium
- drupalDrupal 5.x before 5.19 and 6.x before 6.13 does not properly sanitize failed login attempts for...4.3 Medium
- yasinkaplan tekradiusTekRADIUS 3.0 uses BUILTIN\Users:R permissions for the TekRADIUS.ini file, which allows local...4.6 Medium
- axesstel mv 410rThe Axesstel MV 410R has a certain default administrator password, and does not force a password...10.0 High
- huawei d100The Huawei D100 has (1) a certain default administrator password for the web interface, and does...10.0 High
- apple safariApple Safari before 4.0 does not properly check for revoked Extended Validation (EV) certificates...4.3 Medium
- sun opensolaris, solaris +1 moreKerberos in Sun Solaris 8, 9, and 10, and OpenSolaris before snv_117, does not properly manage...4.7 Medium
- mole-group real estate scriptMole Group Real Estate Script 1.1 and earlier stores passwords in cleartext, which allows context...5.0 Medium
- mole-group lastminute scriptMole Group Lastminute Script 4.0 and earlier stores passwords in cleartext, which allows context...5.0 Medium
- armorlogic profense web application firewallArmorlogic Profense Web Application Firewall before 2.2.22, and 2.4.x before 2.4.4, has a default...10.0 High
- klinzmann application access serverApplication Access Server (A-A-S) 2.0.48 has "wildbat" as its default password for the admin...7.5 High
- llnl slurmSimple Linux Utility for Resource Management (SLURM) 1.2 and 1.3 before 1.3.14 does not properly...7.2 High
- oracle e-business suiteThe Oracle Applications Framework component in Oracle E-Business Suite 12.0.6 and 11i10CU2 uses...7.5 High
- Show moreLoading…