CWE-255: Credentials Management Errors
Weaknesses in this category are related to the management of credentials.
From the CWE List. © The MITRE Corporation.
Newest
- lynx project lynxlynx doesn't properly sanitize user input and exposes database password to unauthorized users7.8 High
- wp-dbmanager project wp-dbmanager(1) wp-dbmanager.php and (2) database-manage.php in the WP-DBManager (aka Database Manager)...7.8 High
- moxa nport w2150a firmware, nport w2250a firmware +1 moreA Credentials Management issue was discovered in Moxa NPort W2150A versions prior to 1.11, and...9.1 Critical
- netapp vasa provider for clustered data ontap, vasa provider +1 moreVersions of VASA Provider for Clustered Data ONTAP prior to 7.0P1 contain a web server that...8.1 High
- kabona webdatorcentralA Plaintext Storage of a Password issue was discovered in Kabona AB WebDatorCentral (WDC)...9.8 Critical
- redhat jboss application server** DISPUTED ** The Embedded Jopr component in JBoss Application Server includes the cleartext...6.6 Medium
- dasanzhone znid 2426a firmwarebackupsettings.html in the web administrative portal in Zhone zNID GPON 2426A before S3.0.501...8.8 High
- juniper junos space, juniper networks junos os +1 moreJunos Space: privilege escalation vulnerabilities in Junos Space9.8 Critical
- apache rangerModerate severity vulnerability that affects org.apache.ranger:ranger6.5 Medium
- multitech faxfinderMultiTech FaxFinder before 4.1.2 stores Passwords unencrypted for maintaining the test...9.8 Critical
- polycom realpresence resource managerMultiple directory traversal vulnerabilities in Polycom RealPresence Resource Manager (aka RPRM)...6.5 Medium
- polycom realpresence resource managerPolycom RealPresence Resource Manager (aka RPRM) before 8.4 allows local users to have...7.8 High
- ntt docomo, inc. wi-fi station l-02f, nttdocomo wi-fi station l-02f firmware +1 moreWi-Fi STATION L-02F Software version V10g and earlier allows remote attackers to access the...9.8 Critical
- hcl sametimeIBM Sametime Meeting Server 8.5.2 and 9.0 could store credentials of the Sametime Meetings user...7.8 High
- freeipaFreeIPA uses a default password policy that locks an account after 5 unsuccessful authentication...7.5 High
- zte zxv10 w300 firmwareZTE ADSL ZXV10 W300 modems W300V2.1.0f_ER7_PE_O57 and W300V2.1.0h_ER7_PE_O57 allow user accounts...8.8 High
- zte zxv10 w300 firmwareZTE ADSL ZXV10 W300 modems W300V2.1.0f_ER7_PE_O57 and W300V2.1.0h_ER7_PE_O57 allow remote...8.8 High
- wago 750-849 firmware, 750-881 firmware, 758-870 firmware +2 moreWAGO IO 750-849 01.01.27 and 01.02.05, WAGO IO 750-881, and WAGO IO 758-870 have weak credential...9.8 Critical
- zyxel pk5001z firmwareZyXEL PK5001Z devices have zyad5001 as the su password, which makes it easier for remote...8.8 High
- mediawikiThe MWOAuthDataStore::lookup_token function in Extension:OAuth for MediaWiki 1.25.x before 1.25.3...9.8 Critical
- redhat satellitediscovery-debug in Foreman before 6.2 when the ssh service has been enabled on discovered nodes...7.0 High
- redhat storage console, storage console node +1 morerhscon-ceph in Red Hat Storage Console 2 x86_64 and Red Hat Storage Console Node 2 x86_64 allows...7.8 High
- pulpproject pulp, fedoraproject fedora +1 morePulp before 2.8.5 uses bash's $RANDOM in an unsafe way to generate passwords.7.5 High
- redhat quickstart cloud installer/var/lib/ovirt-engine/setup/engine-DC-config.py in Red Hat QuickStart Cloud Installer (QCI)...9.8 Critical
- ibm tivoli key lifecycle manager, security key lifecycle manager +1 moreIBM Tivoli Key Lifecycle Manager does not require that users should have strong passwords by...9.8 Critical
- ibm qradar siem, qradar security information and event manager +1 moreIBM QRadar 7.2 and 7.3 stores user credentials in plain in clear text which can be read by an...6.5 Medium
- broadcom advanced secure gateway, symantec corporation asg, proxysg +1 more +3 moreSymantec Advanced Secure Gateway (ASG) 6.6 prior to 6.6.5.13, ASG 6.7 prior to 6.7.3.1, ProxySG 6...7.8 High
- hcl software bigfix inventoryIBM BigFix Inventory 9.2 does not require that users should have strong passwords by default,...5.9 Medium
- lenovo system updateLenovo System Update (formerly ThinkVantage System Update) before 5.07.0019 allows local users to...7.0 High
- seawell networks spectrum sdcSeaWell Networks Spectrum SDC 02.05.00 has a default password of "admin" for the "admin" account.9.8 Critical
- sierrawireless aleos firmwareSierra Wireless GX 440 devices with ALEOS firmware 4.3.2 store passwords in cleartext.9.8 Critical
- sierrawireless aleos firmwareSierra Wireless GX 440 devices with ALEOS firmware 4.3.2 have weak passwords for admin, rauser,...9.8 Critical
- cisco aironet access point firmwareA vulnerability in Cisco Aironet 1830 Series and Cisco Aironet 1850 Series Access Points running...9.8 Critical
- apple iphone os, mac os x +1 moreAn issue was discovered in certain Apple products. iOS before 10.1 is affected. macOS before 10...3.3 Low
- bd alaris 8015 pc unitAn issue was discovered in Becton, Dickinson and Company (BD) Alaris 8015 Point of Care (PC) unit...5.3 Medium
- bd alaris 8015 pc unitAn issue was discovered in Becton, Dickinson and Company (BD) Alaris 8015 Point of Care (PC) unit...4.9 Medium
- moxa nport, nport 5100 series firmware, nport 5100a series firmware +8 more +10 moreAn issue was discovered in Moxa NPort 5110 versions prior to 2.6, NPort 5130/5150 Series versions...3.3 Low
- siemens sicam pas\/pqsAn issue was discovered in Siemens SICAM PAS before 8.00. Because of Storing Passwords in a...7.8 High
- lynxspring jenesys bas bridgeAn issue was discovered in Lynxspring JENEsys BAS Bridge versions 1.1.8 and older. The...9.8 Critical
- moxa iologik e1200 series firmware, iologik e2200 series firmware +1 moreAn issue was discovered in Moxa ioLogik E1210, firmware Version V2.4 and prior, ioLogik E1211,...8.1 High
- ibm security identity manager, ibm corporation identity manager +1 moreIBM Security Identity Manager Virtual Appliance stores user credentials in plain in clear text...7.8 High
- ibm tivoli storage manager, tivoli storage manager for virtual environments data protection for vmware +1 moreIBM Tivoli Storage Manager discloses unencrypted login credentials to Vmware vCenter that could...6.5 Medium
- hcl software bigfix inventory, ibm license metric tool +1 moreIBM BigFix Inventory v9 9.2 stores user credentials in plain in clear text which can be read by a...5.5 Medium
- ibm integration busIBM Integration Bus, under non default configurations, could allow a remote user to authenticate...5.9 Medium
- ibm kenexa lcms premier, ibm corporation kenexa lcms premier on cloud +1 moreIBM Kenexa LCMS Premier on Cloud stores user credentials in plain in clear text which can be read...6.5 Medium
- joomla joomla\!Joomla! 3.4.4 through 3.6.3 allows attackers to reset username, password, and user group...9.8 Critical
- hiteksoftware automizeInformation Disclosure can occur in encryptionProfiles.jsd in Hitek Software's Automize because...8.1 High
- hiteksoftware automizeInformation Disclosure can occur in Hitek Software's Automize 10.x and 11.x passManager.jsd....8.1 High
- blackberry enterprise serviceAn information disclosure vulnerability in the Core and Management Console in BlackBerry...8.1 High
- vmware vsphere data protectionVMware vSphere Data Protection (VDP) 5.5.x though 6.1.x has an SSH private key with a publicly...9.8 Critical
- Show moreLoading…