CWE-255: Credentials Management Errors
Weaknesses in this category are related to the management of credentials.
From the CWE List. © The MITRE Corporation.
Newest
- gehealthcare centricity image vault firmwareGE Healthcare Centricity Image Vault 3.x has a password of (1) gemnet for the administrator...10.0 High
- gehealthcare discovery vhGE Healthcare Discovery VH has a default password of (1) interfile for the ftpclient user of the...10.0 High
- gehealthcare millennium mg firmware, millennium myosight firmware, millennium nc firmware +2 moreGE Healthcare Millennium MG, NC, and MyoSIGHT has a password of insite.genieacq for the insite...10.0 High
- gehealthcare entegra p\&rGE Healthcare eNTEGRA P&R has a password of (1) entegra for the entegra user, (2) passme for the...10.0 High
- cisco unified meetingplace web conferencingThe password-change feature in Cisco Unified MeetingPlace Web Conferencing before 8.5(5) MR3 and...10.0 High
- hospira lifecare pca3, lifecare pca5, lifecare pcainfusion firmware +2 moreHospira LifeCare PCA Infusion System before 7.0 stores private keys and certificates, which has...4.6 Medium
- cisco unified communications domain managerPlatform Software before 4.4.5 in Cisco Unified Communications Domain Manager (CDM) 8.x has a...5.0 Medium
- ibm powervcIBM PowerVC Standard Edition 1.2.2.1 through 1.2.2.2 does not require authentication for access...4.6 Medium
- sap netweaverThe (1) Cross-System Tools and (2) Data Transfer Workbench in SAP NetWeaver have hardcoded...7.5 High
- toshiba checCreateBossCredentials.jar in Toshiba CHEC before 6.6 build 4014 and 6.7 before build 4329...5.0 Medium
- pearson proctorcachePearson ProctorCache before 2015.1.17 uses the same hardcoded password across different customers...5.0 Medium
- sysaidSysAid Help Desk before 15.2 uses a hardcoded password of Password1 for the sa SQL Server Express...5.0 Medium
- redhat openstackThe puppet manifests in the Red Hat openstack-puppet-modules package before 2014.2.13-2 uses a...10.0 High
- emc powerpath virtual applianceEMC PowerPath Virtual Appliance (aka vApp) before 2.0 has default passwords for the (1) emcupdate...5.0 Medium
- inductiveautomation ignitionInductive Automation Ignition 7.7.2 uses MD5 password hashes, which makes it easier for context...5.0 Medium
- websense triton ap emailThe Personal Email Manager (PEM) in Websense TRITON AP-EMAIL before 8.0.0 allows attackers to...5.0 Medium
- servision hvg video gateway firmwareThe web interface on SerVision HVG Video Gateway devices with firmware before 2.2.26a100 has a...10.0 High
- fortinet fortiauthenticatorFortinet FortiAuthenticator 3.0.0 has a password of (1) slony for the slony PostgreSQL user and ...7.5 High
- schneider electric etg3000 factorycast hmi gateway, schneider-electric etg3000 factorycast hmi gateway firmware, tsxetg3000 +3 more +5 moreSchneider Electric ETG3000 FactoryCast HMI Gateway Use of Hard-coded Credentials10.0
- ceragon fiberair ip-10c, fiberair ip-10e, fiberair ip-10g +2 moreCeragon FibeAir IP-10 bridges have a default password for the root account, which makes it easier...7.8 High
- phoenix contact multiprog, proconos, phoenixcontact-software proconos eclr +2 morePhoenix Contact Software ProConOs and MultiProg Missing Authentication for Critical Function10.0
- redhat cloudforms 3.1 management engineThe customization template in Red Hat CloudForms 3.1 Management Engine (CFME) 5.3 uses a default...10.0 High
- cisco webex meetings serverCisco WebEx Meetings Server 1.5 presents the same CAPTCHA challenge for each login attempt, which...5.0 Medium
- basic-cms sweetriceThe password-reset feature in as/index.php in SweetRice CMS before 0.6.7.1 allows remote...4.3 Medium
- ecryptfs ecryptfs-utilseCryptfs 104 and earlier uses a default salt to encrypt the mount passphrase, which makes it...5.0 Medium
- pwgen project pwgenPassword Generator (aka Pwgen) before 2.07 generates weak non-tty passwords, which makes it...5.0 Medium
- arris touchstone tg862g\/ct firmwareARRIS Touchstone TG862G/CT Telephony Gateway with firmware 7.6.59S.CT and earlier has a default...10.0 High
- zenoss coreZenoss Core through 5 Beta 3 uses a weak algorithm to hash passwords, which makes it easier for...5.0 Medium
- zenoss coreZenoss Core through 5 Beta 3 does not require complex passwords, which makes it easier for remote...5.0 Medium
- digicom dg-5514t adsl router firmwareDigicom DG-5514T ADSL router with firmware 3.2 generates predictable session IDs, which allows...10.0 High
- zte zxdslZTE ZXDSL 831CII has a default password of admin for the admin account, which allows remote...10.0 High
- ibm javaIBM Java Runtime Environment (JRE) 7 R1 before SR1 FP1 (7.1.1.1), 7 before SR7 FP1 (7.0.7.1), 6...6.4 Medium
- services project servicesThe _user_resource_create function in the Services module 7.x-3.x before 7.x-3.10 for Drupal uses...7.5 High
- moodleMoodle Temporary Passwords are Brute Force-able7.5 High
- monstraMonstra 3.0.1 and earlier uses a cookie to track how many login attempts have been attempted,...5.0 Medium
- ibm security identity managerIBM Security Identity Manager 6.x before 6.0.0.3 IF14 allows remote attackers to discover...5.0 Medium
- compal broadband networks cg6640e wireless gateway, firmware, ch664oe wireless gateway +2 moreThe Compal Broadband Networks (CBN) CH6640E and CG6640E Wireless Gateway 1.0 with firmware CH6640...10.0 High
- redhat libvirtThe virDomainGetXMLDesc API in Libvirt before 1.2.11 allows remote read-only users to obtain the...5.0 Medium
- mcafee network data loss preventionMcAfee Network Data Loss Prevention (NDLP) before 9.3 allows local users to obtain sensitive...3.6 Low
- mcafee endpoint encryption for files and folders, file and removable media protection +1 moreThe (1) Removable Media and (2) CD and DVD encryption offsite access options (formerly Endpoint...2.1 Low
- ibm sterling b2b integratorThe Change Password feature in IBM Sterling B2B Integrator 5.2.x through 5.2.4 does not have a...5.0 Medium
- apple iphone osThe QuickType feature in the Keyboards subsystem in Apple iOS before 8.1 collects typing...1.9 Low
- carefusion pyxis supplystationCareFusion Pyxis SupplyStation 8.1 with hardware test tool before 1.0.16 allows local users to...1.9 Low
- carefusion pyxis supplystationCareFusion Pyxis SupplyStation 8.1 with hardware test tool before 1.0.16 has a hardcoded service...9.7 High
- carefusion pyxis supplystationCareFusion Pyxis SupplyStation 8.1 with hardware test tool 1.0.16 and earlier has a hardcoded...6.8 Medium
- carefusion pyxis supplystationCareFusion Pyxis SupplyStation 8.1 with hardware test tool before 1.0.16 has a hardcoded...3.5 Low
- ibm websphere mq, websphere mq explorer +1 moreIBM WebSphere MQ classes for Java libraries 8.0 before 8.0.0.1 and Websphere MQ Explorer 7.5...1.9 Low
- mit kerberos 5The kadm5_randkey_principal_3 function in lib/kadm5/srv/svr_principal.c in kadmind in MIT...2.1 Low
- mmonit m\/monitM/Monit 3.3.2 and earlier does not verify the original password before changing passwords, which...7.5 High
- cobham aviator 700d, aviator 700e +1 moreCobham Aviator 700D and 700E satellite terminals use an improper algorithm for PIN codes, which...7.2 High
- Show moreLoading…