CWE-255: Credentials Management Errors
Weaknesses in this category are related to the management of credentials.
From the CWE List. © The MITRE Corporation.
Newest
- apple iphone osMail in Apple iOS before 8 does not prevent sending a LOGIN command to a LOGINDISABLED IMAP...5.0 Medium
- apple safari, iphone os +1 moreSafari in Apple iOS before 8 does not properly restrict the autofilling of passwords in forms,...5.0 Medium
- ibm san volume controller software, storwize v3500, storwize v3700 +2 more +4 moreIBM Storwize 3500, 3700, 5000, and 7000 devices and SAN Volume Controller 6.x and 7.x before 7.2...7.5 High
- netgear prosafe firmwareThe NETGEAR ProSafe Plus Configuration Utility creates configuration backup files containing...3.3 Low
- ibm initiate master data serviceIBM Initiate Master Data Service 9.5 before 9.5.093013, 9.7 before 9.7.093013, 10.0 before 10.0...5.0 Medium
- ibm cognos tm1The client in IBM Cognos TM1 9.5.2.3 before IF5, 10.1.1.2 before IF1, 10.2.0.2 before IF1, and 10...4.0 Medium
- solarwinds log and event managerSolarWinds Log and Event Manager before 6.0 uses "static" credentials, which makes it easier for...7.5 High
- ibm infosphere master data management, infosphere master data management server for product information management +1 moreIBM InfoSphere Master Data Management - Collaborative Edition 10.x before 10.1-FP11 and 11.x...5.0 Medium
- openstack keystone, canonical ubuntu linux +1 moreOpenStack Keystone Domain-scoped tokens don't get revoked4.9 Medium
- openstack keystone, canonical ubuntu linux +1 moreOpenStack Identity (Keystone) UUID v2 tokens does not expire with revocation events4.9 Medium
- openstack keystone, canonical ubuntu linux +1 moreOpenStack Identity (Keystone) Multiple vulnerabilities in revocation events4.9 Medium
- zoll monitor\/defibrillatorZOLL Defibrillator / Monitor X Series has a default (1) supervisor password and (2) service...4.9 Medium
- zoll monitor\/defibrillatorZOLL Defibrillator / Monitor M Series, E Series, and R Series have a default password for System...4.9 Medium
- ibm infosphere optim data growth solution for siebel crmThe Data Growth Solution for JD Edwards EnterpriseOne in IBM InfoSphere Optim 3.0 through 9.1 has...4.0 Medium
- apache subversion, apple xcode, canonical ubuntu linux +6 more +8 moreApache Subversion 1.0.0 through 1.7.x before 1.7.17 and 1.8.x before 1.8.10 uses an MD5 hash of...4.0 Medium
- ui unifi controllerUbiquiti UniFi Controller before 3.2.1 logs the administrative password hash in syslog messages,...2.6 Low
- zte zxv10 w300, zxv10 w300 firmware +1 moreThe ZTE ZXV10 W300 router with firmware W300V1.0.0a_ZRD_LK has a default password of admin for...7.8 High
- yealink sip-t38gconfig/.htpasswd in Yealink IP Phone SIP-T38G has a hardcoded password of (1) user (s7C9Cx.rLsWFA...10.0 High
- infoblox netmriInfoblox NetMRI before 6.8.5 has a default password of admin for the "root" MySQL database...7.2 High
- redhat cloudforms 3.0 management enginelib/util/miq-password.rb in Red Hat CloudForms 3.0 Management Engine (CFME) before 5.2.4.2 uses a...4.3 Medium
- redhat cloudforms 3.0 management engineRed Hat CloudForms 3.0 Management Engine (CFME) before 5.2.4.2 logs the root password when...4.9 Medium
- netgear gs108pe, gs108pe firmware +1 moreNETGEAR GS108PE Prosafe Plus switches with firmware 1.2.0.5 have a hardcoded password of...8.3 High
- cisco unified cdm platform software, unified communications domain manager +1 moreCisco Unified Communications Domain Manager (CDM) in Unified CDM Platform Software before 4.4.2...10.0 High
- cisco cloud portalForm Data Viewer in Cisco Intelligent Automation for Cloud in Cisco Cloud Portal places passwords...4.0 Medium
- sap open hub serviceSAP Open Hub Service has hardcoded credentials, which makes it easier for remote attackers to...5.0 Medium
- sap capacity levelingSAP Capacity Leveling has hardcoded credentials, which makes it easier for remote attackers to...5.0 Medium
- sap transaction data poolSAP Transaction Data Pool has hardcoded credentials, which makes it easier for remote attackers...5.0 Medium
- sap computing center management system monitoringSAP CCMS Monitoring (BC-CCM-MON) has hardcoded credentials, which makes it easier for remote...5.0 Medium
- sap web services toolSAP Web Services Tool (CA-WUI-WST) has hardcoded credentials, which makes it easier for remote...5.0 Medium
- sap upgrade toolsThe SAP Upgrade tools for ABAP has hardcoded credentials, which makes it easier for remote...5.0 Medium
- sap oil industry solution traders and schedulers workbenchThe SAP Trader's and Scheduler's Workbench (TSW) for SAP Oil & Gas has hardcoded credentials,...5.0 Medium
- sap brazilSAP Brazil add-on has hardcoded credentials, which makes it easier for remote attackers to obtain...5.0 Medium
- sap project systemThe (1) Structures and (2) Project-Oriented Procurement components in SAP Project System has...5.0 Medium
- livezillaLiveZilla before 5.1.1.0 stores the admin Base64 encoded username and password in a 1click file,...2.1 Low
- mambo-foundation mambo cmsMambo CMS 4.6.5 stores the MySQL database password in cleartext in the document root, which...2.1 Low
- redhat sos, canonical ubuntu linux +1 moresosreport in Red Hat sos 1.7 and earlier on Red Hat Enterprise Linux (RHEL) 5 produces an archive...5.0 Medium
- cogent datahub, cogentdatahub cogent datahub +1 moreCogent DataHub Use of Password Hash With Insufficient Computational Effort6.0
- redhat rhevm-dwhThe setup script in ovirt-engine-dwh, as used in the Red Hat Enterprise Virtualization Manager...2.1 Low
- sosreport project sosreportSOSreport stores the md5 hash of the GRUB bootloader password in an archive, which allows local...4.3 Medium
- emerson deltavEmerson DeltaV Use of Hard-coded Credentials2.4
- vicidialVICIDIAL dialer (aka Asterisk GUI client) 2.8-403a, 2.7, 2.7RC1, and earlier has a hardcoded...5.0 Medium
- microsoft windows, windows 7, windows 8 +4 more +6 moreThe Group Policy implementation in Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2...9.0 High
- foscam ip camera firmwareFoscam IP camera 11.37.2.49 and other versions, when using the Foscam DynDNS option, generates...10.0 High
- jenkins-ci subversion-pluginJenkins Subversion Plugin Stores Credentials with Base64 Encoding2.1 Low
- f5 big-iqF5 BIG-IQ Cloud and Security 4.0.0 through 4.1.0 allows remote authenticated users to change the...9.0 High
- phusion juviaJuvia uses the same secret key for all installations, which allows remote attackers to have...7.5 High
- dkorunic pam s\/keyA certain Gentoo patch for the PAM S/Key module does not properly clear credentials from memory,...2.1 Low
- redhat jboss fuse, jboss a-mq +1 moreExposure of Sensitive Information to an Unauthorized Actor in JBoss Fuse2.1 Low
- emc cloud tiering appliance, file management appliance, cloud tiering appliance software +1 more +3 moreEMC Cloud Tiering Appliance (CTA) 9.x through 10 SP1 and File Management Appliance (FMA) 7.x...4.7 Medium
- paperthin commonspot content serverThe default configuration of PaperThin CommonSpot before 7.0.2 and 8.x before 8.0.3 uses...5.0 Medium
- Show moreLoading…