CWE-255: Credentials Management Errors
Weaknesses in this category are related to the management of credentials.
From the CWE List. © The MITRE Corporation.
Newest
- ui unifi controller, unifi +1 moreSMTP MITM refers to a malicious actor setting up an SMTP proxy server between the UniFi...8.1 High
- dlink dir-655 firmwareD-Link DIR-655 C devices before 3.02B05 BETA03 allow remote attackers to force a blank password...9.8 Critical
- amcrest ipm-721s firmwareAmcrest IPM-721S V2.420.AC00.16.R.20160909 devices allow an unauthenticated attacker to download...9.8 Critical
- riello-ups netman 204 firmwareAn issue was discovered in Riello NetMan 204 14-2 and 15-2. The issue is with the login script...9.8 Critical
- cloudera managerThe keystore password for the Spark History Server may be exposed in unsecured files under the ...7.5 High
- dlink dcs-1100 firmware, dcs-1130 firmware +1 moreAn issue was discovered on D-Link DCS-1100 and DCS-1130 devices. The device requires that a user...8.8 High
- ishekar endoscope camera firmwareRecently it was discovered as a part of the research on IoT devices in the most recent firmware...6.5 Medium
- getvera veraedge firmware, veralite firmware +1 moreAn issue was discovered on Vera Veralite 1.7.481 devices. The device has an additional OpenWRT...9.8 Critical
- ibm iIBM i 7.27.3 Clustering could allow a local attacker to obtain sensitive information, caused by...5.9 Medium
- starry s00111 firmwareStarry Station (aka Starry Router) sets the Access-Control-Allow-Origin header to "*". This...8.8 High
- schneider-electric modicon quantum firmwareA CWE-255 Credentials Management vulnerability exists in Modicon Quantum with firmware versions...6.5 Medium
- kie kie-serverPassword in config file in KIE server5.9 Medium
- mobatek mobaxtermIn MobaTek MobaXterm Personal Edition v11.1 Build 3860, the SSH private key and its password can...9.8 Critical
- cisco adaptive security appliance software, adaptive security appliance (asa) software, firepower threat defense (ftd) software +1 more +3 moreCisco Adaptive Security Appliance Software and Firepower Threat Defense Software VPN SAML Authentication Bypass Vulnerability5.8 Medium
- ubuntu maas, canonical metal as a service +1 moreProbe-and-enlist for SeaMicro chassis writes password to the log5.5 Medium
- cisco ap-cos, aironet access point software +1 moreCisco Aironet Series Access Points Development Shell Access Vulnerability7.8 High
- 3m detcon sitewatch gateway, detcon sitewatch gateway +1 moreDetcon Sitewatch Gateway, all versions without cellular, Passwords are presented in plaintext in...9.8 Critical
- rockwell automation plc5, rslogix, slc5/0x +2 more +4 moreRockwell PLC5/SLC5/0x/RSLogix Credentials management9.8 Critical
- baxter sigma spectrum infusion system, sigma spectrum infusion system firmware +1 moreAn unauthenticated remote attacker may be able to execute commands to view wireless account...9.8 Critical
- apache airflowApache Airflow vulnerable to XSS9.8 Critical
- brocade network advisor, netapp brocade network advisor +1 moreA vulnerability in Brocade Network Advisor Versions before 14.3.1 could allow an unauthenticated,...8.1 High
- mailenableMailEnable before 8.60 allows Privilege Escalation because admin accounts could be created as a...9.8 Critical
- open dental dental, opendental +1 moreOpen Dental before version 18.4 installs a mysql database and uses the default credentials of ...9.8 Critical
- gnome seahorse** DISPUTED ** GNOME Seahorse through 3.30 allows physically proximate attackers to read...6.8 Medium
- cisco prime collaboration provisioning, prime collaboration +1 moreCisco Prime Collaboration Provisioning Intermittent Hard-Coded Password Vulnerability9.8 Critical
- manageengine applications manager, zohocorp manageengine applications manager +1 moreManageEngine Applications Manager 12 and 13 is vulnerable to privilege escalation and authentication bypass8.8 High
- synology ds107 firmware, ds116 firmware, ds213 firmware +3 more +5 moreSynology NAS servers DS107, DS116, and DS213, use default credentials9.8 Critical
- nuuo nt-4040 titan, nt-4040 titan firmware +1 moreNuuo NT-4040 Titan, firmware NT-4040_01.07.0000.0015_1120, uses default credentials9.8 Critical
- green packet wifi access point, greenpacket dx-350 firmware +1 moreGreen Packet DX-350 uses default credentials9.8 Critical
- intellian satellite tv antennas, intelliantech t100q firmware, t100w firmware +11 more +13 moreIntellian Satellite TV antennas t-Series and v-Series, firmware version 1.07, uses default credentials9.8 Critical
- nutspace nut mobile, zizai technology tech nut mobile application +1 moreZizai Tech Nut stores the account password in cleartext7.8 High
- itrack easy, kkmcn itrackeasy +1 moreiTrack Easy mobile application stores the user password in base-64 encoding/cleartext7.8 High
- ibm websphere portalIBM WebSphere Portal 7.0.0.x and 8.0.0.x write passwords to a trace file when tracing is enabled...7.8 High
- trackr bravo mobile application, thetrackr trackr bravo firmware +1 moreTrackR Bravo mobile application stores account passwords in cleartext8.8 High
- cisco prime collaboration, prime collaboration provisioning +1 moreA vulnerability in the password recovery function of Cisco Prime Collaboration Provisioning (PCP)...9.8 Critical
- cisco prime collaboration, prime collaboration provisioning +1 moreA vulnerability in the password reset function of Cisco Prime Collaboration Provisioning (PCP)...9.8 Critical
- grunt-gh-pages project grunt-gh-pages, hackerone grunt-gh-pages node module +1 moregrunt-gh-pages before 0.10.0 may allow unencrypted GitHub credentials to be written to a log file8.6 High
- hackerone keystone node module, keystonejs keystone +1 moreAuthentication Weakness in keystone7.5 High
- cisco mobility express softwareA vulnerability in the assignment and management of default user accounts for Secure Shell (SSH)...7.5 High
- ibm endpoint manager for remote control, tivoli remote control +1 moreIBM Endpoint Manager for Remote Control 9.0.0 and 9.0.1 and Tivoli Remote Control 5.1.2 store...8.8 High
- ibm security key lifecycle managerThe installation process in IBM Security Key Lifecycle Manager 2.5 stores unencrypted credentials...4.1 Medium
- ibm security identity manager, tivoli identity manager +1 moreIBM Tivoli Identity Manager 5.1.x before 5.1.0.15-ISS-TIM-IF0057 and Security Identity Manager 6...7.8 High
- theforeman foreman, unspecified foreman-debug, redhat satellite +2 moreforeman-debug before version 1.15.0 is vulnerable to a flaw in foreman-debug's logging. An...4.7 Medium
- phoenix contact ilc plcs, phoenixcontact ilc plcs firmware +1 moreWebvisit in Phoenix Contact ILC PLCs offers a password macro to protect HMI pages on the PLC...7.3 High
- vmware pivotal software mysqlMySQL for PCF tiles 1.7.x before 1.7.10 were discovered to log the AWS access key in plaintext....10.0 Critical
- thycotic secret serverThe Remote Desktop Launcher in Thycotic Secret Server before 8.6.000010 does not properly cleanup...9.8 Critical
- ring firmwareRing (formerly DoorBot) video doorbells allow remote attackers to obtain sensitive information...4.6 Medium
- web2pyweb2py before 2.14.1, when using the standalone version, allows remote attackers to obtain...7.8 High
- echor project echorEchor Ruby Gem credentials can be stolen via process table monitoring7.8 High
- bmc track-it\!BMC Track-It! 11.4 before Hotfix 3 exposes an unauthenticated .NET remoting configuration service...9.8 Critical
- Show moreLoading…