CWE-255: Credentials Management Errors
Weaknesses in this category are related to the management of credentials.
From the CWE List. © The MITRE Corporation.
Newest
- siemens synco ozw web server, synco ozw web server firmware +1 moreThe Siemens Synco OZW Web Server devices OZW672.*, OZW772.*, and OZW775 with firmware before 4...7.5 High
- f5 enterprise manager, big-ip 1000, big-ip 11000 +22 more +24 moreF5 BIG-IP appliances 9.x before 9.4.8-HF5, 10.x before 10.2.4, 11.0.x before 11.0.0-HF2, and 11.1...7.8 High
- libguestfsvirt-edit in libguestfs before 1.18.0 does not preserve the permissions from the original file...2.1 Low
- redhat sosThe sosreport utility in the Red Hat sos package before 2.2-29 does not remove the root user...4.3 Medium
- david paleino wicdWicd before 1.7.1 saves sensitive information in log files in /var/log/wicd, which allows context...2.1 Low
- mikel olasagasti revelationRevelation 0.4.13-2 and earlier does not iterate through SHA hashing algorithms for AES...5.0 Medium
- mikel olasagasti revelationRevelation 0.4.13-2 and earlier uses only the first 32 characters of a password followed by a...5.0 Medium
- ibm security appscan sourceThe ODBC driver in IBM Security AppScan Source 7.x and 8.x before 8.6 sends an SHA-1 hash of the...5.0 Medium
- bandainamcogames madomagi-ip androidThe Puella Magi Madoka Magica iP application 1.05 and earlier for Android places cleartext...4.3 Medium
- bestpractical rtThe vulnerable-passwords script in Best Practical Solutions RT 3.x before 3.8.12 and 4.x before 4...5.0 Medium
- xelex mobiletrackThe Xelex MobileTrack application 2.3.7 and earlier for Android uses hardcoded credentials, which...2.6 Low
- wellintech kingscada, kingview +1 moreWellinTech KingSCADA Missing Encryption of Sensitive Data7.1
- spreecommerce spreeSpree uses a hardcoded hash value5.0 Medium
- spreecommerce spreeSpree does not properly restrict the use of a hash to provide values for a model's attributes5.0 Medium
- insoshiInsoshi before 20080920 does not properly restrict the use of a hash to provide values for a...5.0 Medium
- redmineRedmine before 1.3.2 does not properly restrict the use of a hash to provide values for a model's...5.0 Medium
- ibm ts3310 tape library, quantum scalar i500, dell powervault ml6000 +6 more +8 moreThe Quantum Scalar i500 tape library with firmware before i7.0.3 (604G.GS00100), also distributed...7.5 High
- rsa envisionEMC RSA enVision 4.x before 4.1 Patch 4 uses unspecified hardcoded credentials, which makes it...9.3 High
- moodleThe rc4encrypt function in lib/moodlelib.php in Moodle 1.9.x before 1.9.16, 2.0.x before 2.0.7, 2...5.0 Medium
- moodlelib/moodlelib.php in Moodle 1.9.x before 1.9.15, 2.0.x before 2.0.6, and 2.1.x before 2.1.3 does...6.8 Medium
- utc fire \& security ge-mc100-ntp\/gps-zb master clock deviceThe UTC Fire & Security GE-MC100-NTP/GPS-ZB Master Clock device uses hardcoded credentials for an...10.0 High
- openbsd opensshThe auth_parse_options function in auth-options.c in sshd in OpenSSH before 5.7 provides debug...3.5 Low
- emc sourceone email managementThe Web Search feature in EMC SourceOne Email Management 6.5 before 6.5.2.4033, 6.6 before 6.6.1...2.1 Low
- ecryptfs ecryptfs-utils, utils +1 moreThe encrypted private-directory setup process in utils/ecryptfs-setup-private in ecryptfs-utils...4.4 Medium
- gplhost domain technologie controlDomain Technologie Control (DTC) before 0.34.1 includes a password in the -b command line...2.1 Low
- parallels plesk panelThe Control Panel in Parallels Plesk Panel 10.4.4_build20111103.18 generates a password form...9.3 High
- parallels plesk small business panelParallels Plesk Small Business Panel 10.2.0 generates a password form field without disabling the...10.0 High
- parallels plesk panelThe billing system for Parallels Plesk Panel 10.3.1_build1013110726.09 generates a password form...10.0 High
- parallels plesk panelThe Control Panel in Parallels Plesk Panel 10.2.0 build 20110407.20 generates a password form...10.0 High
- parallels plesk panelThe Server Administration Panel in Parallels Plesk Panel 10.2.0_build1011110331.18 generates a...10.0 High
- oneclickorgs one click orgsThe password reset feature in One Click Orgs before 1.2.3 generates different error messages for...5.0 Medium
- oneclickorgs one click orgsOne Click Orgs before 1.2.3 does not require unique e-mail addresses for user accounts, which...4.0 Medium
- dell kace k2000 systems deployment applianceThe Dell KACE K2000 System Deployment Appliance has a default username and password for the read...4.3 Medium
- dlink dcs-2121, dcs-2121 firmware +1 more/etc/rc.d/rc.local on the D-Link DCS-2121 camera with firmware 1.04 configures a hardcoded...9.0 High
- apple mac os x, mac os x server +1 moreOpen Directory in Apple Mac OS X 10.7 before 10.7.2 allows local users to read the password data...2.1 Low
- apple iphone osThe WiFi component in Apple iOS before 5 stores WiFi credentials in an unspecified file, which...4.3 Medium
- apple iphone osThe Settings component in Apple iOS before 5 stores a cleartext parental-restrictions passcode in...2.1 Low
- apple iphone osCFNetwork in Apple iOS before 5 stores AppleID credentials in an unspecified file, which makes it...4.3 Medium
- apple iphone osThe Keyboards component in Apple iOS before 5 displays the final character of an entered password...2.1 Low
- cisco identity services engine, identity services engine software +1 moreCisco Identity Services Engine (ISE) before 1.0.4.MR2 has default Oracle database credentials,...10.0 High
- cisco telepresence recording server softwareCisco TelePresence Recording Server 1.7.2.x before 1.7.2.1 has a default password for the root...10.0 High
- mozilla firefox, seamonkey +1 moreThe implementation of Content Security Policy (CSP) violation reports in Mozilla Firefox 4.x...5.0 Medium
- emc data protection advisorEMC Data Protection Advisor before 5.8.1 places cleartext account credentials in the DPA...2.1 Low
- apple cfnetwork, safari +1 moreCFNetwork in Apple Safari before 5.0.6 on Windows allows remote web servers to execute arbitrary...9.3 High
- haxx libcurl, apple mac os x, canonical ubuntu linux +2 more +4 moreThe Curl_input_negotiate function in http_negotiate.c in libcurl 7.10.6 through 7.21.6, as used...4.3 Medium
- cisco cns network registrarCisco Network Registrar before 7.2 has a default administrative password, which makes it easier...10.0 High
- cisco media processing software, media experience engine 5600 +1 moreCisco Media Processing Software before 1.2 on Media Experience Engine (MXE) 5600 devices has a...10.0 High
- trustwave webdefendTrustwave WebDefend Enterprise before 5.0 7.01.903-1.4 stores specific user-account credentials...5.0 Medium
- trustwave webdefendThe application server in Trustwave WebDefend Enterprise before 5.0 uses hardcoded console...5.0 Medium
- ibm tivoli directory serverThe LDAP_ADD implementation in IBM Tivoli Directory Server (TDS) 5.2 before 5.2.0.5-TIV-ITDS...2.1 Low
- Show moreLoading…