CWE-255 (page 8)
Page 8 of 8 — CVEs classified under CWE-255, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2008-3235 | | 2008-07-21 | Unspecified vulnerability in the PropFilePasswordEncoder utility in the Security component in IBM WebSphere Application Server (WAS) 5.1 before 5.1.1.19 has un… | |
CVE-2008-3067 | | 2008-07-07 | sudo in SUSE openSUSE 10.3 does not clear the stdin buffer when password entry times out, which might allow local users to obtain a password by reading stdin f… | |
CVE-2008-1676 | | 2008-07-07 | Red Hat PKI Common Framework (rhpki-common) in Red Hat Certificate System (aka Certificate Server or RHCS) 7.1 through 7.3, and Netscape Certificate Management… | |
CVE-2008-2857 | | 2008-06-25 | AlstraSoft AskMe Pro 2.1 and earlier stores passwords in cleartext in a MySQL database, which allows context-dependent attackers to obtain sensitive informatio… | |
CVE-2008-0535 | | 2008-05-22 | Unspecified vulnerability in the SSH server in (1) Cisco Service Control Engine (SCE) before 3.1.6, and (2) Icon Labs Iconfidant SSH before 2.3.8, allows remot… | |
CVE-2008-2291 | | 2008-05-18 | axengine.exe in Symantec Altiris Deployment Solution 6.8.x and 6.9.x before 6.9.176 generates credentials with a fixed salt or without any salt, which makes it… | |
CVE-2008-2279 | | 2008-05-16 | Freelance Auction Script 1.0 stores user passwords in plaintext in the tbl_users table, which allows attackers to gain privileges by reading the table. | |
CVE-2008-1880 | | 2008-05-12 | The default configuration of Firebird before 2.0.3.12981.0-r6 on Gentoo Linux sets the ISC_PASSWORD environment variable before starting Firebird, which allows… | |
CVE-2008-1970 | | 2008-04-27 | muCommander before 0.8.2 stores credentials.xml with insecure permissions, which allows local users to obtain credentials. | |
CVE-2008-1543 | | 2008-03-28 | The Advanced User Interface Pages in the ProST Web Management component on the Airspan WiMAX ProST have a certain default User ID and password, which makes it… | |
CVE-2008-1542 | | 2008-03-28 | Airspan Base Station Distribution Unit (BSDU) has "topsecret" as its password for the root account, which allows remote attackers to obtain administrative acce… | |
CVE-2008-1529 | | 2008-03-26 | ZyXEL Prestige routers have a minimum password length for the admin account that is too small, which makes it easier for remote attackers to guess passwords vi… | |
CVE-2008-1390 | | 2008-03-24 | The AsteriskGUI HTTP server in Asterisk Open Source 1.4.x before 1.4.19-rc3 and 1.6.x before 1.6.0-beta6, Business Edition C.x.x before C.1.6, AsteriskNOW befo… | |
CVE-2008-1396 | | 2008-03-20 | Plone CMS 3.x uses invariant data (a client username and a server secret) when calculating an HMAC-SHA1 value for an authentication cookie, which makes it easi… | |
CVE-2008-1394 | | 2008-03-20 | Plone CMS before 3 places a base64 encoded form of the username and password in the __ac cookie for all user accounts, which makes it easier for remote attacke… | |
CVE-2008-1393 | | 2008-03-20 | Plone CMS 3.0.5, and probably other 3.x versions, places a base64 encoded form of the username and password in the __ac cookie for the admin account, which mak… | |
CVE-2008-0996 | | 2008-03-18 | The Printing component in Apple Mac OS X 10.5.2 might save authentication credentials to disk when starting a job on an authenticated print queue, which might… | |
CVE-2008-1218 | | 2008-03-10 | Argument injection vulnerability in Dovecot 1.0.x before 1.0.13, and 1.1.x before 1.1.rc3, when using blocking passdbs, allows remote attackers to bypass the p… | |
CVE-2008-1184 | | 2008-03-06 | The DNSSEC validation library (libval) library in dnssec-tools before 1.3.1 does not properly check that the signing key is the APEX trust anchor, which might… | |
CVE-2008-0901 | | 2008-02-22 | BEA WebLogic Server and Express 7.0 through 10.0 allows remote attackers to conduct brute force password guessing attacks, even when account lockout has been a… | |
CVE-2008-0724 | | 2008-02-12 | The Everything Development Engine in The Everything Development System Pre-1.0 and earlier stores passwords in cleartext in a database, which makes it easier f… | |
CVE-2008-0604 | | 2008-02-06 | The LDAP authentication feature in XLight FTP Server before 2.83, when used with some unspecified LDAP servers, does not check for blank passwords, which allow… | |
CVE-2007-6340 | | 2008-02-05 | Geert Moernaut LSrunasE 1.0 and Supercrypt 1.0 use the RC4 stream cipher without constructing a unique initialization vector (IV), which makes it easier for lo… | |
CVE-2008-0440 | | 2008-01-23 | AlstraSoft Forum Pay Per Post Exchange 2.0 stores passwords in cleartext, which makes it easier for attackers to access user accounts. | |
CVE-2008-0029 | | 2008-01-23 | Cisco Application Velocity System (AVS) before 5.1.0 is installed with default passwords for some system accounts, which allows remote attackers to gain privil… | |
CVE-2007-6661 | | 2008-01-04 | 2z project 0.9.6.1 allows attackers to change the password without supplying the old password. | |
CVE-2007-6414 | | 2007-12-17 | admin/administrator.php in Adult Script 1.6 and earlier sends a redirect to the web browser but does not exit, which allows remote attackers to bypass authenti… | |
CVE-2007-6399 | | 2007-12-17 | index.php in Flat PHP Board 1.2 and earlier allows remote authenticated users to obtain the password for the current user account by reading the password param… | |
CVE-2007-6329 | | 2007-12-13 | Microsoft Office 2007 12.0.6015.5000 and MSO 12.0.6017.5000 do not sign the metadata of Office Open XML (OOXML) documents, which makes it easier for remote att… | |
CVE-2007-6267 | | 2007-12-07 | Citrix EdgeSight 4.2 and 4.5 for Presentation Server, EdgeSight 4.2 and 4.5 for Endpoints, and EdgeSight for NetScaler 1.0 and 1.1 do not properly store databa… | |
CVE-2007-6260 | | 2007-12-06 | The installation process for Oracle 10g and llg uses accounts with default passwords, which allows remote attackers to obtain login access by connecting to the… | |
CVE-2007-6096 | | 2007-11-22 | Ingate Firewall before 4.6.0 and SIParator before 4.6.0 use cleartext storage for passwords of "administrators with less privileges," which might allow attacke… | |
CVE-2007-5905 | | 2007-11-15 | Adobe ColdFusion 8 and MX 7 allows remote attackers to hijack sessions via unspecified vectors that trigger establishment of a session to a ColdFusion applicat… | |
CVE-2007-5988 | | 2007-11-15 | blocks/shoutbox_block.php in BtiTracker 1.4.4 does not verify user accounts, which allows remote attackers to post shoutbox entries as arbitrary users via a mo… | |
CVE-2007-4994 | | 2007-11-06 | Certificate Server 7.2 in Red Hat Certificate System (RHCS) does not properly handle new revocations that occur while a Certificate Revocation List (CRL) is be… | |
CVE-2007-5579 | | 2007-10-18 | login.php in Pligg CMS 9.5 uses a guessable confirmation code when resetting a forgotten password, which allows remote attackers with knowledge of a username t… | |
CVE-2007-5063 | | 2007-09-24 | Adam Scheinberg Flip 3.0 and earlier stores sensitive information under the web root with insufficient access control, which allows remote attackers to downloa… | |
CVE-2007-4960 | | 2007-09-18 | Argument injection vulnerability in the Linden Lab Second Life secondlife:// protocol handler, as used in Internet Explorer and possibly Firefox, allows remote… | |
CVE-2007-4656 | | 2007-09-04 | backup-manager-upload in Backup Manager before 0.6.3 provides the FTP server hostname, username, and password as plaintext command line arguments during FTP up… | |
CVE-2007-4598 | | 2007-08-30 | IBM SurePOS 500 has (1) a default password of "12345" for the manager and (2) blank default passwords for operator accounts. | |
CVE-2007-4594 | | 2007-08-29 | Entrust Entelligence Security Provider (ESP) 8 does not properly validate certificates in certain circumstances involving (1) a chain that omits the root Certi… | |
CVE-2007-4526 | | 2007-08-25 | The Client Login Extension (CLE) in Novell Identity Manager before 3.5.1 20070730 stores the username and password in a local file, which allows local users to… | |
CVE-2007-4261 | | 2007-08-08 | EZPhotoSales 1.9.3 and earlier stores sensitive information under the web root with insufficient access control, which allows remote attackers to download (1)… | |
CVE-2007-3978 | | 2007-07-25 | Session fixation vulnerability in bwired allows remote attackers to hijack web sessions by setting the PHPSESSID parameter. | |
CVE-2007-3275 | | 2007-06-19 | MailWasher Server before 2.2.1, when used with LDAP or Active Directory (AD), does not properly handle blank passwords, which allows remote attackers to access… | |
CVE-2007-3061 | | 2007-06-06 | Cactushop 6 and earlier stores sensitive information under the web root with insufficient access control, which allows remote attackers to download a database… | |
CVE-2007-2766 | | 2007-05-18 | lib/backup-methods.sh in Backup Manager before 0.7.6 provides the MySQL password as a plaintext command line argument, which allows local users to obtain this… | |
CVE-2007-1068 | | 2007-02-22 | The (1) TTLS CHAP, (2) TTLS MSCHAP, (3) TTLS MSCHAPv2, (4) TTLS PAP, (5) MD5, (6) GTC, (7) LEAP, (8) PEAP MSCHAPv2, (9) PEAP GTC, and (10) FAST authentication… | |
CVE-2007-0057 | | 2007-01-04 | Cisco Clean Access (CCA) 3.6.x through 3.6.4.2 and 4.0.x through 4.0.3.2 does not properly configure or allow modification of a shared secret authentication ke… | |
CVE-2006-6239 | | 2006-12-03 | webadmin in MailEnable NetWebAdmin Professional 2.32 and Enterprise 2.32 allows remote attackers to authenticate using an empty password. | |
CVE-2006-4068 | | 2006-08-10 | The pswd.js script relies on the client to calculate whether a username and password match hard-coded hashed values for a server, and uses a hashing scheme tha… | |
CVE-2006-2481 | | 2006-07-31 | VMware ESX Server 2.0.x before 2.0.2 and 2.x before 2.5.2 patch 4 stores authentication credentials in base 64 encoded format in the vmware.mui.kid and vmware… | |
CVE-2006-3203 | | 2006-06-24 | The installation of Ultimate PHP Board (UPB) 1.9.6 and earlier includes a default administrator login account and password, which allows remote attackers to ga… | |
CVE-2006-1002 | | 2006-03-06 | NETGEAR WGT624 Wireless DSL router has a default account of super_username "Gearguy" and super_passwd "Geardog", which allows remote attackers to modify the co… | |
CVE-2005-4862 | | 2005-12-31 | The search functionality in XWiki 0.9.793 indexes cleartext user passwords, which allows remote attackers to obtain sensitive information via a search string t… | |
CVE-2005-2666 | | 2005-08-23 | SSH, as implemented in OpenSSH before 4.0 and possibly other implementations, stores hostnames, IP addresses, and keys in plaintext in the known_hosts file, wh… | |
CVE-2004-2723 | | 2004-12-31 | NessusWX 1.4.4 stores account passwords in plaintext in .session files, which allows local users to obtain passwords. | |
CVE-2004-2722 | | 2004-12-31 | Nessus 2.0.10a stores account passwords in plaintext in .nessusrc files, which allows local users to obtain passwords. NOTE: the original researcher reports t… | |
CVE-2004-2708 | | 2004-12-31 | Gyach Enhanced (Gyach-E) before 1.0.0 stores passwords in plaintext, which allows attackers to obtain user passwords by reading the configuration file. | |
CVE-2004-2696 | | 2004-12-31 | BEA WebLogic Server and WebLogic Express 6.1, 7.0, and 8.1, when using Remote Method Invocation (RMI) over Internet Inter-ORB Protocol (IIOP), does not properl… | |
CVE-2004-2532 | | 2004-12-31 | Serv-U FTP server before 5.1.0.0 has a default account and password for local administration, which allows local users to execute arbitrary commands by connect… | |
CVE-2004-1366 | | 2004-08-04 | Oracle 10g Database Server stores the password for the SYSMAN account in cleartext in the world-readable emoms.properties file, which could allow local users t… | |
CVE-2003-1483 | | 2003-12-31 | FlashFXP 1.4 uses a weak encryption algorithm for user passwords, which allows attackers to decrypt the passwords and gain access. | |
CVE-2003-1482 | | 2003-12-31 | The backup configuration file for Microsoft MN-500 wireless base station stores administrative passwords in plaintext, which allows local users to gain access. | |
CVE-2003-1439 | | 2003-12-31 | Secure Internet Live Conferencing (SILC) 0.9.11 and 0.9.12 stores passwords and sessions in plaintext in memory, which could allow local users to obtain sensit… | |
CVE-2003-1424 | | 2003-12-31 | message.php in Petitforum does not properly authenticate users, which allows remote attackers to impersonate forum users via a modified connect cookie. | |
CVE-2003-1417 | | 2003-12-31 | nCipher Support Software 6.00, when using generatekey KeySafe to import keys, does not delete the temporary copies of the key, which may allow local users to g… | |
CVE-2003-1401 | | 2003-12-31 | login.php in php-Board 1.0 stores plaintext passwords in $username.txt with insufficient access control under the web document root, which allows remote attack… | |
CVE-2003-1394 | | 2003-12-31 | CoffeeCup Software Password Wizard 4.0 stores sensitive information such as usernames and passwords in a .apw file under the web document root with insufficien… | |
CVE-2003-1376 | | 2003-12-31 | WinZip 8.0 uses weak random number generation for password protected ZIP files, which allows local users to brute force the encryption keys and extract the dat… | |
CVE-2002-2412 | | 2002-12-31 | Winamp 2.80 stores authentication credentials in plaintext in the (1) [HTTP-AUTH] and (2) [winamp] sections in winamp.ini, which allows local users to gain acc… | |
CVE-2002-2389 | | 2002-12-31 | TheServer 1.74 web server stores server.ini under the web document root with insufficient access control, which allows remote attackers to obtain cleartext pas… | |
CVE-2002-2384 | | 2002-12-31 | hotfoon4.exe in Hotfoon 4.00 stores user names and passwords in cleartext in the hotfoon2 registry key, which allows local users to gain access to user account… | |
CVE-2002-2355 | | 2002-12-31 | Netgear FM114P firmware 1.3 wireless firewall, when configured to backup configuration information, stores DDNS (DynDNS) user name and password, MAC address fi… | |
CVE-2002-2345 | | 2002-12-31 | Oracle 9i Application Server 9.0.2 stores the web cache administrator interface password in plaintext, which allows remote attackers to gain access. | |
CVE-2002-2310 | | 2002-12-31 | ClickCartPro 4.0 stores the admin_user.db data file under the web document root with insufficient access control on servers other than Apache, which allows rem… | |
CVE-2002-2301 | | 2002-12-31 | Lawson Financials 8.0, when configured to use a third party relational database, stores usernames and passwords in a world-readable file, which allows local us… | |
CVE-2002-2290 | | 2002-12-31 | Mambo Site Server 4.0.11 installs with a default username and password of admin, which allows remote attackers to gain privileges. | |
CVE-1999-0994 | | 1999-12-16 | Windows NT with SYSKEY reuses the keystream that is used for encrypting SAM password hashes, allowing an attacker to crack passwords. | |
CVE-1999-0387 | | 1999-11-29 | A legacy credential caching mechanism used in Windows 95 and Windows 98 systems allows attackers to read plaintext network passwords. | |
CVE-1999-0755 | | 1999-05-27 | Windows NT RRAS and RAS clients cache a user's password even if the user has not selected the "Save password" option. | |
CVE-1999-1214 | | 1997-09-15 | The asynchronous I/O facility in 4.4 BSD kernel does not check user credentials when setting the recipient of I/O notification, which allows local users to cau… |