CWE-255 (page 2)
Page 2 of 8 — CVEs classified under CWE-255, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2016-6599 | Critical | 9.8 | 2018-01-30 | BMC Track-It! 11.4 before Hotfix 3 exposes an unauthenticated .NET remoting configuration service (ConfigurationService) on port 9010. This service contains a… |
CVE-2014-5002 | High | 7.8 | 2018-01-10 | The lynx gem before 1.0.0 for Ruby places the configured password on command lines, which allows local users to obtain sensitive information by listing process… |
CVE-2014-8335 | High | 7.8 | 2018-01-05 | (1) wp-dbmanager.php and (2) database-manage.php in the WP-DBManager (aka Database Manager) plugin before 2.7.2 for WordPress place credentials on the mysqldum… |
CVE-2017-16727 | Critical | 9.1 | 2017-12-22 | A Credentials Management issue was discovered in Moxa NPort W2150A versions prior to 1.11, and NPort W2250A versions prior to 1.11. The default password is emp… |
CVE-2016-6904 | High | 8.1 | 2017-12-11 | Versions of VASA Provider for Clustered Data ONTAP prior to 7.0P1 contain a web server that accepts plain text authentication. This could allow an unauthentica… |
CVE-2016-0872 | Critical | 9.8 | 2017-11-07 | A Plaintext Storage of a Password issue was discovered in Kabona AB WebDatorCentral (WDC) versions prior to Version 3.4.0. WDC stores password credentials in p… |
CVE-2013-3734 | Medium | 6.6 | 2017-10-24 | The Embedded Jopr component in JBoss Application Server includes the cleartext datasource password in unspecified HTML responses, which might allow (1) man-in-… |
CVE-2014-8357 | High | 8.8 | 2017-10-17 | backupsettings.html in the web administrative portal in Zhone zNID GPON 2426A before S3.0.501 places a session key in a URL, which allows remote attackers to o… |
CVE-2016-1265 | Critical | 9.8 | 2017-10-13 | A remote unauthenticated network based attacker with access to Junos Space may execute arbitrary code on Junos Space or gain access to devices managed by Junos… |
CVE-2016-6815 | Medium | 6.5 | 2017-10-13 | In Apache Ranger before 0.6.2, users with "keyadmin" role should not be allowed to change password for users with "admin" role. |
CVE-2016-10512 | Critical | 9.8 | 2017-09-30 | MultiTech FaxFinder before 4.1.2 stores Passwords unencrypted for maintaining the test connectivity function of its LDAP configuration. These credentials are r… |
CVE-2015-4684 | Medium | 6.5 | 2017-09-19 | Multiple directory traversal vulnerabilities in Polycom RealPresence Resource Manager (aka RPRM) before 8.4 allow (1) remote authenticated users to read arbitr… |
CVE-2015-4681 | High | 7.8 | 2017-09-19 | Polycom RealPresence Resource Manager (aka RPRM) before 8.4 allows local users to have unspecified impact via vectors related to weak passwords. |
CVE-2017-10845 | Critical | 9.8 | 2017-09-15 | Wi-Fi STATION L-02F Software version V10g and earlier allows remote attackers to access the device with administrative privileges and perform unintended operat… |
CVE-2016-2972 | High | 7.8 | 2017-08-29 | IBM Sametime Meeting Server 8.5.2 and 9.0 could store credentials of the Sametime Meetings user in the local cache of their browser which could be accessed by… |
CVE-2016-7030 | High | 7.5 | 2017-08-28 | FreeIPA uses a default password policy that locks an account after 5 unsuccessful authentication attempts, which allows remote attackers to cause a denial of s… |
CVE-2015-7259 | High | 8.8 | 2017-08-24 | ZTE ADSL ZXV10 W300 modems W300V2.1.0f_ER7_PE_O57 and W300V2.1.0h_ER7_PE_O57 allow user accounts to have multiple valid username and password pairs, which allo… |
CVE-2015-7258 | High | 8.8 | 2017-08-24 | ZTE ADSL ZXV10 W300 modems W300V2.1.0f_ER7_PE_O57 and W300V2.1.0h_ER7_PE_O57 allow remote authenticated users to obtain user passwords by displaying user infor… |
CVE-2015-6472 | Critical | 9.8 | 2017-08-22 | WAGO IO 750-849 01.01.27 and 01.02.05, WAGO IO 750-881, and WAGO IO 758-870 have weak credential management. |
CVE-2016-10401 | High | 8.8 | 2017-07-25 | ZyXEL PK5001Z devices have zyad5001 as the su password, which makes it easier for remote attackers to obtain root access if a non-root account password is know… |
CVE-2015-8009 | Critical | 9.8 | 2017-07-25 | The MWOAuthDataStore::lookup_token function in Extension:OAuth for MediaWiki 1.25.x before 1.25.3, 1.24.x before 1.24.4, and before 1.23.11 does not properly v… |
CVE-2016-4996 | High | 7.0 | 2017-07-17 | discovery-debug in Foreman before 6.2 when the ssh service has been enabled on discovered nodes displays the root password in plaintext in the system journal w… |
CVE-2016-7062 | High | 7.8 | 2017-06-27 | rhscon-ceph in Red Hat Storage Console 2 x86_64 and Red Hat Storage Console Node 2 x86_64 allows local users to obtain the password as cleartext. |
CVE-2016-3704 | High | 7.5 | 2017-06-13 | Pulp before 2.8.5 uses bash's $RANDOM in an unsafe way to generate passwords. |
CVE-2016-5411 | Critical | 9.8 | 2017-06-13 | /var/lib/ovirt-engine/setup/engine-DC-config.py in Red Hat QuickStart Cloud Installer (QCI) before 1.0 GA is created world readable and contains the root passw… |
CVE-2016-6093 | Critical | 9.8 | 2017-06-08 | IBM Tivoli Key Lifecycle Manager does not require that users should have strong passwords by default, which makes it easier for attackers to compromise user ac… |
CVE-2016-9750 | Medium | 6.5 | 2017-05-15 | IBM QRadar 7.2 and 7.3 stores user credentials in plain in clear text which can be read by an authenticated user. IBM X-Force ID: 120207. |
CVE-2016-9100 | High | 7.8 | 2017-05-11 | Symantec Advanced Secure Gateway (ASG) 6.6 prior to 6.6.5.13, ASG 6.7 prior to 6.7.3.1, ProxySG 6.5 prior to 6.5.10.6, ProxySG 6.6 prior to 6.6.5.13, and Proxy… |
CVE-2016-8962 | Medium | 5.9 | 2017-04-26 | IBM BigFix Inventory 9.2 does not require that users should have strong passwords by default, which makes it easier for attackers to compromise user accounts… |
CVE-2015-8109 | High | 7.0 | 2017-04-24 | Lenovo System Update (formerly ThinkVantage System Update) before 5.07.0019 allows local users to gain privileges by making a prediction of tvsu_tmp_xxxxxXXXXX… |
CVE-2015-8282 | Critical | 9.8 | 2017-04-13 | SeaWell Networks Spectrum SDC 02.05.00 has a default password of "admin" for the "admin" account. |
CVE-2016-5070 | Critical | 9.8 | 2017-04-10 | Sierra Wireless GX 440 devices with ALEOS firmware 4.3.2 store passwords in cleartext. |
CVE-2016-5066 | Critical | 9.8 | 2017-04-10 | Sierra Wireless GX 440 devices with ALEOS firmware 4.3.2 have weak passwords for admin, rauser, sconsole, and user. |
CVE-2017-3834 | Critical | 9.8 | 2017-04-06 | A vulnerability in Cisco Aironet 1830 Series and Cisco Aironet 1850 Series Access Points running Cisco Mobility Express Software could allow an unauthenticated… |
CVE-2015-8626 | Critical | 9.8 | 2017-03-23 | The User::randomPassword function in MediaWiki before 1.23.12, 1.24.x before 1.24.5, 1.25.x before 1.25.4, and 1.26.x before 1.26.1 generates passwords smaller… |
CVE-2016-4670 | Low | 3.3 | 2017-02-20 | An issue was discovered in certain Apple products. iOS before 10.1 is affected. macOS before 10.12.1 is affected. The issue involves the "Security" component… |
CVE-2016-9355 | Medium | 5.3 | 2017-02-13 | An issue was discovered in Becton, Dickinson and Company (BD) Alaris 8015 Point of Care (PC) unit, Version 9.5 and prior versions, and Version 9.7. An unauthor… |
CVE-2016-8375 | Medium | 4.9 | 2017-02-13 | An issue was discovered in Becton, Dickinson and Company (BD) Alaris 8015 Point of Care (PC) unit, Version 9.5 and prior versions, and Version 9.7, and 8000 PC… |
CVE-2016-9348 | Low | 3.3 | 2017-02-13 | An issue was discovered in Moxa NPort 5110 versions prior to 2.6, NPort 5130/5150 Series versions prior to 3.6, NPort 5200 Series versions prior to 2.8, NPort… |
CVE-2016-8566 | High | 7.8 | 2017-02-13 | An issue was discovered in Siemens SICAM PAS before 8.00. Because of Storing Passwords in a Recoverable Format, an authenticated local attacker with certain pr… |
CVE-2016-8378 | Critical | 9.8 | 2017-02-13 | An issue was discovered in Lynxspring JENEsys BAS Bridge versions 1.1.8 and older. The application's database lacks sufficient safeguards for protecting creden… |
CVE-2016-8372 | High | 8.1 | 2017-02-13 | An issue was discovered in Moxa ioLogik E1210, firmware Version V2.4 and prior, ioLogik E1211, firmware Version V2.3 and prior, ioLogik E1212, firmware Version… |
CVE-2016-9739 | High | 7.8 | 2017-02-01 | IBM Security Identity Manager Virtual Appliance stores user credentials in plain in clear text which can be read by a local user. |
CVE-2016-6110 | Medium | 6.5 | 2017-02-01 | IBM Tivoli Storage Manager discloses unencrypted login credentials to Vmware vCenter that could be obtained by a local user. |
CVE-2016-8967 | Medium | 5.5 | 2017-02-01 | IBM BigFix Inventory v9 9.2 stores user credentials in plain in clear text which can be read by a local user. |
CVE-2016-8918 | Medium | 5.9 | 2017-02-01 | IBM Integration Bus, under non default configurations, could allow a remote user to authenticate without providing valid credentials. |
CVE-2016-5950 | Medium | 6.5 | 2017-02-01 | IBM Kenexa LCMS Premier on Cloud stores user credentials in plain in clear text which can be read by an authenticated user. |
CVE-2016-9081 | Critical | 9.8 | 2017-01-23 | Joomla! 3.4.4 through 3.6.3 allows attackers to reset username, password, and user group assignments and possibly perform other user account modifications via… |
CVE-2016-10103 | High | 8.1 | 2017-01-23 | Information Disclosure can occur in encryptionProfiles.jsd in Hitek Software's Automize because of the Read attribute being set for Users. This allows an attac… |
CVE-2016-10101 | High | 8.1 | 2017-01-23 | Information Disclosure can occur in Hitek Software's Automize 10.x and 11.x passManager.jsd. Users have the Read attribute, which allows an attacker to recover… |
CVE-2016-3130 | High | 8.1 | 2017-01-13 | An information disclosure vulnerability in the Core and Management Console in BlackBerry Enterprise Server (BES) 12 through 12.5.2 allows remote attackers to o… |
CVE-2016-7456 | Critical | 9.8 | 2016-12-29 | VMware vSphere Data Protection (VDP) 5.5.x though 6.1.x has an SSH private key with a publicly known password, which makes it easier for remote attackers to ob… |
CVE-2013-1430 | Critical | 9.8 | 2016-12-16 | An issue was discovered in xrdp before 0.9.1. When successfully logging in using RDP into an xrdp session, the file ~/.vnc/sesman_${username}_passwd is created… |
CVE-2016-4028 | High | 7.5 | 2016-12-15 | An issue was discovered in Open-Xchange OX Guard before 2.4.0-rev8. OX Guard uses an authentication token to identify and transfer guest users' credentials. T… |
CVE-2016-3685 | Medium | 4.7 | 2016-12-14 | SAP Download Manager 2.1.142 and earlier generates an encryption key from a small key space on Windows and Mac systems, which allows context-dependent attacker… |
CVE-2016-9204 | Medium | 6.5 | 2016-12-14 | A vulnerability in the Cisco Intercloud Fabric (ICF) Director could allow an unauthenticated, remote attacker to connect to internal services with an internal… |
CVE-2016-9479 | High | 7.5 | 2016-12-02 | The "lost password" functionality in b2evolution before 6.7.9 allows remote attackers to reset arbitrary user passwords via a crafted request. |
CVE-2016-2871 | High | 7.8 | 2016-11-30 | IBM QRadar SIEM 7.1 before MR2 Patch 13 and 7.2 before 7.2.7 uses cleartext storage for unspecified passwords, which allows local users to obtain sensitive inf… |
CVE-2016-5890 | Medium | 5.3 | 2016-11-30 | IBM Sterling B2B Integrator 5.2 before 5020500_14 and 5.2 06 before 5020602_1 allows remote authenticated users to change arbitrary passwords via unspecified v… |
CVE-2016-2936 | High | 7.3 | 2016-11-30 | IBM BigFix Remote Control before 9.1.3 uses cleartext storage for unspecified passwords, which allows local users to obtain sensitive information via unknown v… |
CVE-2016-3946 | High | 7.8 | 2016-10-13 | SAP Console (aka SAPConsole) 7.30 allows local users to discover SAP Server login credentials by reading the Windows registry, aka SAP Security Note 2121461. |
CVE-2016-6531 | Critical | 9.8 | 2016-09-24 | Open Dental 16.1 and earlier has a hardcoded MySQL root password, which allows remote attackers to obtain administrative access by leveraging access to intrane… |
CVE-2015-8945 | Medium | 5.1 | 2016-08-05 | openshift-node in OpenShift Origin 1.1.6 and earlier improperly stores router credentials as envvars in the pod when the --credentials option is used, which al… |
CVE-2016-5670 | Critical | 9.8 | 2016-08-03 | Crestron Electronics DM-TXRX-100-STR devices with firmware before 1.3039.00040 have a hardcoded password of admin for the admin account, which makes it easier… |
CVE-2016-0330 | High | 7.3 | 2016-07-15 | IBM Security Identity Manager (ISIM) Virtual Appliance 7.0.0.0 through 7.0.1.1 before 7.0.1-ISS-SIM-FP0003 mishandles password creation, which makes it easier… |
CVE-2016-3749 | High | 8.4 | 2016-07-11 | server/LockSettingsService.java in LockSettingsService in Android 6.x before 2016-07-01 allows attackers to modify the screen-lock password or pattern via a cr… |
CVE-2016-5848 | Medium | 6.7 | 2016-07-04 | Siemens SICAM PAS before 8.07 does not properly restrict password data in the database, which makes it easier for local users to calculate passwords by leverag… |
CVE-2016-1394 | High | 8.6 | 2016-07-03 | Cisco Firepower System Software 6.0.0 through 6.1.0 has a hardcoded account, which allows remote attackers to obtain CLI access by leveraging knowledge of the… |
CVE-2016-5838 | High | 7.5 | 2016-06-29 | WordPress before 4.5.3 allows remote attackers to bypass intended password-change restrictions by leveraging knowledge of a cookie. |
CVE-2015-8289 | High | 7.5 | 2016-06-20 | The password-recovery feature on NETGEAR D3600 devices with firmware 1.0.0.49 and D6000 devices with firmware 1.0.0.49 and earlier allows remote attackers to d… |
CVE-2015-7462 | Medium | 4.4 | 2016-06-19 | IBM WebSphere MQ 8.0.0.4 on IBM i platforms allows local users to discover cleartext certificate-keystore passwords within MQ trace output by leveraging admini… |
CVE-2016-4527 | Low | 3.3 | 2016-06-10 | ABB PCM600 before 2.7 improperly stores PCM600 authentication credentials, which allows local users to obtain sensitive information via unspecified vectors. |
CVE-2016-2311 | Medium | 6.5 | 2016-05-30 | Black Box AlertWerks ServSensor with firmware before SP473, AlertWerks ServSensor Junior with firmware before SP473, AlertWerks ServSensor Junior with PoE with… |
CVE-2016-4325 | Critical | 9.8 | 2016-05-14 | Lantronix xPrintServer devices with firmware before 5.0.1-65 have hardcoded credentials, which allows remote attackers to obtain root access via unspecified ve… |
CVE-2016-1601 | Critical | 9.8 | 2016-04-26 | yast2-users before 3.1.47, as used in SUSE Linux Enterprise 12 SP1, does not properly set empty password fields in /etc/shadow during an AutoYaST installation… |
CVE-2016-2331 | Critical | 9.8 | 2016-04-25 | The web interface on SysLINK SL-1000 Machine-to-Machine (M2M) Modular Gateway devices with firmware before 01A.8 has a default password, which makes it easier… |
CVE-2016-2203 | High | 7.8 | 2016-04-22 | The management console on Symantec Messaging Gateway (SMG) Appliance devices before 10.6.1 allows local users to discover an encrypted AD password by leveragin… |
CVE-2015-7921 | Critical | 9.1 | 2016-04-06 | The FTP server in Pro-face GP-Pro EX EX-ED before 4.05.000, PFXEXEDV before 4.05.000, PFXEXEDLS before 4.05.000, and PFXEXGRPLS before 4.05.000 has hardcoded c… |
CVE-2016-2283 | Medium | 5.3 | 2016-03-04 | Moxa ioLogik E2200 devices before 3.12 and ioAdmin Configuration Utility before 3.18 do not properly encrypt data, which makes it easier for remote attackers t… |
CVE-2016-2282 | Medium | 5.3 | 2016-03-04 | Moxa ioLogik E2200 devices before 3.12 and ioAdmin Configuration Utility before 3.18 do not properly encrypt credentials, which makes it easier for remote atta… |
CVE-2016-1356 | Low | 3.7 | 2016-03-03 | Cisco FireSIGHT System Software 6.1.0 does not use a constant-time algorithm for verifying credentials, which makes it easier for remote attackers to enumerate… |
CVE-2015-7261 | Critical | 9.8 | 2016-02-27 | The FTP service in QNAP iArtist Lite before 1.4.54, as distributed with QNAP Signage Station before 2.0.1, has hardcoded credentials, which makes it easier for… |
CVE-2016-1341 | Critical | 9.8 | 2016-02-24 | Cisco NX-OS 7.0(1)N1(1), 7.0(1)N1(3), and 7.0(4)N1(1) on Nexus 2000 Fabric Extender devices has a blank root password, which allows local users to gain privile… |
CVE-2016-1927 | High | 7.5 | 2016-02-20 | The suggestPassword function in js/functions.js in phpMyAdmin 4.0.x before 4.0.10.13, 4.4.x before 4.4.15.3, and 4.5.x before 4.5.4 relies on the Math.random J… |
CVE-2016-0865 | High | 8.8 | 2016-02-13 | Tollgrade SmartGrid LightHouse Sensor Management System (SMS) Software EMS before 5.1, and 4.1.0 Build 16, allows remote authenticated users to change arbitrar… |
CVE-2016-0049 | Medium | 6.2 | 2016-02-10 | Kerberos in Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1, Windows Server 2012 Gold and R2, and Windows 10 Gold a… |
CVE-2015-3252 | Critical | 9.8 | 2016-02-08 | Apache CloudStack before 4.5.2 does not properly preserve VNC passwords when migrating KVM virtual machines, which allows remote attackers to gain access by co… |
CVE-2016-2230 | Critical | 9.8 | 2016-02-08 | OpenELEC and RasPlex devices have a hardcoded password for the root account, which makes it easier for remote attackers to obtain access via an SSH session. |
CVE-2015-2012 | Medium | 4.0 | 2016-02-08 | The MQXR service in WMQ Telemetry in IBM WebSphere MQ 7.1 before 7.1.0.7, 7.5 through 7.5.0.5, and 8.0 before 8.0.0.4 uses world-readable permissions for a cle… |
CVE-2016-1307 | Medium | 5.4 | 2016-02-07 | The Openfire server in Cisco Finesse Desktop 10.5(1) and 11.0(1) and Unified Contact Center Express 10.6(1) has a hardcoded account, which makes it easier for… |
CVE-2015-7915 | Critical | 9.8 | 2016-02-06 | Sauter EY-WS505F0x0 moduWeb Vision before 1.6.0 sends cleartext credentials, which allows remote attackers to obtain sensitive information by sniffing the netw… |
CVE-2016-1491 | High | 8.8 | 2016-01-26 | The Wifi hotspot in Lenovo SHAREit before 3.2.0 for Windows, when configured to receive files, has a hardcoded password of 12345678, which makes it easier for… |
CVE-2016-1984 | Critical | 9.8 | 2016-01-22 | The setUpSubtleUserAccount function in /bin/bw on Harman AMX devices before 2016-01-20 has a hardcoded password for the 1MB@tMaN account, which makes it easier… |
CVE-2015-8362 | Critical | 9.8 | 2016-01-22 | The setUpSubtleUserAccount function in /bin/bw on Harman AMX devices before 2015-10-12 has a hardcoded password for the BlackWidow account, which makes it easi… |
CVE-2015-6412 | Critical | 9.8 | 2016-01-22 | Cisco Modular Encoding Platform D9036 Software before 02.04.70 has hardcoded (1) root and (2) guest passwords, which makes it easier for remote attackers to ob… |
CVE-2015-8675 | Medium | 6.2 | 2016-01-15 | Huawei S5300 Campus Series switches with software before V200R005SPH008 do not mask the password when uploading files, which allows physically proximate attack… |
CVE-2015-6336 | High | 7.3 | 2016-01-15 | Cisco Aironet 1800 devices with software 7.2, 7.3, 7.4, 8.1(112.3), 8.1(112.4), and 8.1(15.14) have a default account, which makes it easier for remote attacke… |
CVE-2015-8673 | Medium | 6.8 | 2016-01-12 | Huawei TE30, TE40, TE50, and TE60 multimedia video conferencing endpoints with software before V100R001C10SPC100 do not require entry of the old password when… |
CVE-2015-8611 | Critical | 9.8 | 2016-01-12 | BIG-IP LTM, AAM, AFM, Analytics, APM, ASM, DNS, Link Controller, and PEM 12.0.0 before HF1 on the 2000, 4000, 5000, 7000, and 10000 platforms do not properly s… |
CVE-2015-5988 | Critical | 9.8 | 2015-12-31 | The web management interface on Belkin F9K1102 2 devices with firmware 2.10.17 has a blank password, which allows remote attackers to obtain administrative pri… |