CWE-521 · Weak Password Requirements (page 2)
Page 2 of 3 — CVEs classified under CWE-521, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2023-37503 | High | 8.1 | 2023-10-19 | HCL Compass is vulnerable to insecure password requirements. An attacker could easily guess the password and gain access to user accounts. |
CVE-2023-37756 | Critical | 9.8 | 2023-09-14 | I-doit pro 25 and below and I-doit open 25 and below employ weak password requirements for Administrator account creation. Attackers are able to easily guess u… |
CVE-2023-40707 | High | 8.6 | 2023-08-24 | There are no requirements for setting a complex password in the built-in web server of the SNAP PAC S1 Firmware version R10.3b, which could allow for a success… |
CVE-2023-4125 | High | 8.8 | 2023-08-03 | Weak Password Requirements in GitHub repository answerdev/answer prior to v1.1.0. |
CVE-2023-34995 | High | 7.5 | 2023-07-07 | There are no requirements for setting a complex password for PiiGAB M-Bus, which could contribute to a successful brute force attack if the pass… |
CVE-2023-3089 | High | 7.0 | 2023-07-05 | A compliance problem was found in the Red Hat OpenShift Container Platform. Red Hat discovered that, when FIPS mode was enabled, not all of the cryptographic m… |
CVE-2023-34240 | Medium | 6.5 | 2023-06-27 | Cloudexplorer-lite is an open source cloud software stack. Weak passwords can be easily guessed and are an easy target for brute force attacks. This can lead t… |
CVE-2023-3423 | High | 8.8 | 2023-06-27 | Weak Password Requirements in GitHub repository cloudexplorer-dev/cloudexplorer-lite prior to v 1.2.0. |
CVE-2023-2060 | High | 7.5 | 2023-06-02 | Weak Password Requirements vulnerability in FTP function on Mitsubishi Electric Corporation MELSEC iQ-R Series EtherNet/IP module RJ71EIP91 and MELSEC iQ-F Ser… |
CVE-2023-31098 | Critical | 9.8 | 2023-05-22 | Weak Password Requirements vulnerability in Apache Software Foundation Apache InLong.This issue affects Apache InLong: from 1.1.0 through 1.6.0. When users c… |
CVE-2023-25184 | High | 7.5 | 2023-05-10 | Use of weak credentials exists in Seiko Solutions SkyBridge and SkySpider series, which may allow a remote unauthenticated attacker to decrypt password for the… |
CVE-2023-25072 | High | 7.5 | 2023-05-10 | Use of weak credentials exists in SkyBridge MB-A100/110 firmware Ver. 4.2.0 and earlier, which may allow a remote unauthenticated attacker to decrypt password… |
CVE-2023-31043 | High | 7.5 | 2023-04-23 | EnterpriseDB EDB Postgres Advanced Server (EPAS) before 14.6.0 logs unredacted passwords in situations where optional parameters are used with CREATE/ALTER USE… |
CVE-2023-2160 | Medium | 6.3 | 2023-04-18 | Weak Password Requirements in GitHub repository modoboa/modoboa prior to 2.1.0. |
CVE-2023-24502 | High | 7.5 | 2023-04-17 | Electra Central AC unit – The unit opens an AP with an easily calculated password. |
CVE-2023-2106 | Critical | 9.8 | 2023-04-15 | Weak Password Requirements in GitHub repository janeczku/calibre-web prior to 0.6.20. |
CVE-2022-34333 | Medium | 5.9 | 2023-04-07 | IBM Sterling Order Management 10.0 does not require that users should have strong passwords by default, which makes it easier for attackers to compromise user… |
CVE-2023-1753 | Medium | 5.5 | 2023-03-31 | Weak Password Requirements in GitHub repository thorsten/phpmyfaq prior to 3.1.12. |
CVE-2022-45635 | High | 7.5 | 2023-03-21 | An issue discovered in MEGAFEIS, BOFEI DBD+ Application for IOS & Android v1.4.4 allows attacker to gain access to sensitive account information via insecure p… |
CVE-2021-36689 | Medium | 5.5 | 2023-03-04 | An issue discovered in com.samourai.wallet.PinEntryActivity.java in Streetside Samourai Wallet 0.99.96i allows attackers to view sensitive information and decr… |
CVE-2023-0793 | High | 7.1 | 2023-02-12 | Weak Password Requirements in GitHub repository thorsten/phpmyfaq prior to 3.1.11. |
CVE-2023-0641 | Low | 3.7 | 2023-02-02 | A vulnerability was found in PHPGurukul Employee Leaves Management System 1.0. It has been declared as problematic. Affected by this vulnerability is an unknow… |
CVE-2022-32513 | Critical | 9.8 | 2023-01-30 | A CWE-521: Weak Password Requirements vulnerability exists that could allow an attacker to gain control of the device when the attacker brute forces the passwo… |
CVE-2023-0569 | Medium | 6.5 | 2023-01-29 | Weak Password Requirements in GitHub repository publify/publify prior to 9.2.10. |
CVE-2023-0564 | Medium | 5.4 | 2023-01-29 | Weak Password Requirements in GitHub repository froxlor/froxlor prior to 2.0.10. |
CVE-2023-0307 | Critical | 9.8 | 2023-01-15 | Weak Password Requirements in GitHub repository thorsten/phpmyfaq prior to 3.1.10. |
CVE-2023-22451 | Medium | 6.5 | 2023-01-02 | Kiwi TCMS is an open source test management system. In version 11.6 and prior, when users register new accounts and/or change passwords, there is no validation… |
CVE-2022-44236 | Critical | 9.8 | 2022-12-15 | Beijing Zed-3 Technologies Co.,Ltd VoIP simpliclty ASG 8.5.0.17807 (20181130-16:12) has a Weak password vulnerability. |
CVE-2021-39434 | High | 7.5 | 2022-12-06 | A default username and password for an administrator account was discovered in ZKTeco ZKTime 10.0 through 11.1.0, builds 20180901, 20190510.1, 20200309.3, 2020… |
CVE-2022-45482 | Critical | 9.8 | 2022-12-02 | Lazy Mouse server enforces weak password requirements and doesn't implement rate limiting, allowing remote unauthenticated users to easily and quickly brute fo… |
CVE-2022-41969 | Low | 2.4 | 2022-12-01 | Nextcloud Server is an open source personal cloud server. Prior to versions 23.0.11, 24.0.7, and 25.0.0, there is no password length limit when creating a user… |
CVE-2022-43030 | High | 7.2 | 2022-11-14 | Siyucms v6.1.7 was discovered to contain a remote code execution (RCE) vulnerability in the background. SIYUCMS is a content management system based on ThinkPa… |
CVE-2022-3754 | Critical | 9.8 | 2022-10-29 | Weak Password Requirements in GitHub repository thorsten/phpmyfaq prior to 3.1.8. |
CVE-2022-3376 | Medium | 5.3 | 2022-10-06 | Weak Password Requirements in GitHub repository ikus060/rdiffweb prior to 2.5.0a4. |
CVE-2022-3326 | Medium | 4.3 | 2022-09-29 | Weak Password Requirements in GitHub repository ikus060/rdiffweb prior to 2.4.9. |
CVE-2022-3268 | Critical | 9.8 | 2022-09-22 | Weak Password Requirements in GitHub repository ikus060/minarca prior to 4.2.2. |
CVE-2022-3179 | High | 8.8 | 2022-09-13 | Weak Password Requirements in GitHub repository ikus060/rdiffweb prior to 2.4.2. |
CVE-2022-27558 | Medium | 5.9 | 2022-08-29 | HCL iNotes is susceptible to a Broken Password Strength Checks vulnerability. Custom password policies are not enforced on certain iNotes forms which could all… |
CVE-2022-37158 | Critical | 9.8 | 2022-08-25 | RuoYi v3.8.3 has a Weak password vulnerability in the management system. |
CVE-2022-34772 | Medium | 4.3 | 2022-08-22 | Tabit - password enumeration. Description: Tabit - password enumeration. The passwords for the Tabit system is a 4 digit OTP. One can resend OTP and try loggin… |
CVE-2022-2927 | Critical | 9.8 | 2022-08-22 | Weak Password Requirements in GitHub repository notrinos/notrinoserp prior to 0.7. |
CVE-2022-34615 | Critical | 9.8 | 2022-08-19 | Mealie 1.0.0beta3 employs weak password requirements which allows attackers to potentially gain unauthorized access to the application via brute-force attacks. |
CVE-2022-35280 | Critical | 9.8 | 2022-08-10 | IBM Robotic Process Automation 21.0.0, 21.0.1, and 21.0.2 does not require that users should have strong passwords by default, which makes it easier for attack… |
CVE-2022-35143 | Critical | 9.8 | 2022-08-04 | Renato v0.17.0 employs weak password complexity requirements, allowing attackers to crack user passwords via brute-force attacks. |
CVE-2022-36301 | Critical | 9.8 | 2022-08-01 | BF-OS version 3.x up to and including 3.83 do not enforce strong passwords which may allow a remote attacker to brute-force the device password. |
CVE-2022-26117 | High | 8.8 | 2022-07-18 | An empty password in configuration file vulnerability [CWE-258] in FortiNAC version 8.3.7 and below, 8.5.2 and below, 8.5.4, 8.6.0, 8.6.5 and below, 8.7.6 and… |
CVE-2022-31211 | Critical | 9.8 | 2022-07-17 | An issue was discovered in Infiray IRAY-A8Z3 1.0.957. There is a blank root password for TELNET by default. |
CVE-2022-28377 | High | 7.5 | 2022-07-14 | On Verizon 5G Home LVSKIHP InDoorUnit (IDU) 3.4.66.162 and OutDoorUnit (ODU) 3.33.101.0 devices, the CRTC and ODU RPC endpoints rely on a static account userna… |
CVE-2022-1668 | Critical | 9.8 | 2022-06-24 | Weak default root user credentials allow remote attackers to easily obtain OS superuser privileges over the open TCP port for SSH. |
CVE-2022-30325 | High | 8.8 | 2022-06-16 | An issue was found on TRENDnet TEW-831DR 1.0 601.130.1.1356 devices. The default pre-shared key for the Wi-Fi networks is the same for every router except for… |
CVE-2022-2098 | Critical | 9.8 | 2022-06-16 | Weak Password Requirements in GitHub repository kromitgmbh/titra prior to 0.78.1. |
CVE-2022-29729 | High | 7.5 | 2022-06-02 | Verizon 4G LTE Network Extender GA4.38 - V0.4.038.2131 utilizes a weak default admin password generation algorithm which generates passwords that are accessibl… |
CVE-2022-29098 | High | 8.1 | 2022-06-01 | Dell PowerScale OneFS versions 8.2.0.x through 9.3.0.x, contain a weak password requirement vulnerability. An administrator may create an account with no passw… |
CVE-2022-1775 | Critical | 9.8 | 2022-05-20 | Weak Password Requirements in GitHub repository polonel/trudesk prior to 1.2.2. |
CVE-2022-29700 | High | 7.5 | 2022-04-27 | A lack of password length restriction in Zammad v5.1.0 allows for the creation of extremely long passwords which can cause a Denial of Service (DoS) during pas… |
CVE-2022-1039 | Critical | 9.6 | 2022-04-20 | The weak password on the web user interface can be exploited via HTTP or HTTPS. Once such access has been obtained, the other passwords can be changed. The wea… |
CVE-2022-1236 | Medium | 6.5 | 2022-04-05 | Weak Password Requirements in GitHub repository weseek/growi prior to v5.0.0. |
CVE-2021-38935 | High | 7.5 | 2022-02-18 | IBM Maximo Asset Management 7.6.1.2 does not require that users should have strong passwords by default, which makes it easier for attackers to compromise user… |
CVE-2022-22110 | High | 7.5 | 2022-01-05 | In Daybyday CRM, versions 1.1 through 2.2.0 enforce weak password requirements in the user update functionality. A user with privileges to update his password… |
CVE-2021-41696 | Medium | 6.5 | 2021-12-09 | An authentication bypass (account takeover) vulnerability exists in Premiumdatingscript 4.2.7.7 due to a weak password reset mechanism in requests\user.php. |
CVE-2021-43471 | High | 7.5 | 2021-12-06 | In Canon LBP223 printers, the System Manager Mode login does not require an account password or PIN. An attacker can remotely shut down the device after enteri… |
CVE-2021-43036 | Critical | 9.8 | 2021-12-06 | An issue was discovered in Kaseya Unitrends Backup Appliance before 10.5.5. The password for the PostgreSQL wguest account is weak. |
CVE-2021-20470 | High | 7.5 | 2021-12-03 | IBM Cognos Analytics 11.1.7 and 11.2.0 does not require that users should have strong passwords by default, which makes it easier for attackers to compromise u… |
CVE-2021-40333 | Critical | 9.0 | 2021-12-02 | Weak Password Requirements vulnerability in Hitachi Energy FOX61x, XCM20 allows an attacker to gain unauthorized access to the Data Communication Network (DCN)… |
CVE-2021-40520 | Critical | 9.8 | 2021-11-10 | Airangel HSMX Gateway devices through 5.2.04 have Weak SSH Credentials. |
CVE-2021-38462 | Critical | 9.8 | 2021-10-19 | InHand Networks IR615 Router's Versions 2.3.0.r4724 and 2.3.0.r4870 does not enforce an efficient password policy. This may allow an attacker with obtained use… |
CVE-2021-35498 | Critical | 9.8 | 2021-10-13 | The TIBCO EBX Web Server component of TIBCO Software Inc.'s TIBCO EBX, TIBCO EBX, TIBCO EBX, and TIBCO Product and Service Catalog powered by TIBCO EBX contain… |
CVE-2021-41296 | Critical | 9.8 | 2021-09-30 | ECOA BAS controller uses weak set of default administrative credentials that can be easily guessed in remote password attacks and gain full control of the syst… |
CVE-2021-28914 | Medium | 6.5 | 2021-09-09 | BAB TECHNOLOGIE GmbH eibPort V3 prior version 3.9.1 allow the user to set a weak password because the strength is shown in configuration tool, but finally not… |
CVE-2021-28912 | High | 7.2 | 2021-09-09 | BAB TECHNOLOGIE GmbH eibPort V3. Each device has its own unique hard coded and weak root SSH key passphrase known as 'eibPort string'. This is usable and the f… |
CVE-2021-20418 | Critical | 9.8 | 2021-08-11 | IBM Security Guardium 11.2 does not require that users should have strong passwords by default, which makes it easier for attackers to compromise user accounts… |
CVE-2021-1522 | Medium | 4.3 | 2021-08-04 | A vulnerability in the change password API of Cisco Connected Mobile Experiences (CMX) could allow an authenticated, remote attacker to alter their own passwor… |
CVE-2021-32753 | High | 8.3 | 2021-07-09 | EdgeX Foundry is an open source project for building a common open framework for internet-of-things edge computing. A vulnerability exists in the Edinburgh, Fu… |
CVE-2021-25923 | High | 8.1 | 2021-06-24 | In OpenEMR, versions 5.0.0 to 6.0.0.1 are vulnerable to weak password requirements as it does not enforce a maximum password length limit. If a malicious user… |
CVE-2021-25839 | Critical | 9.8 | 2021-04-26 | A weak password requirement vulnerability exists in the Create New User function of MintHCM RELEASE 3.0.8, which could lead an attacker to easier password brut… |
CVE-2021-26797 | Critical | 9.8 | 2021-04-26 | An access control vulnerability in Hame SD1 Wi-Fi firmware <=V.20140224154640 allows an attacker to get system administrator through an open Telnet service. |
CVE-2020-11925 | High | 8.8 | 2021-04-02 | An issue was discovered in Luvion Grand Elite 3 Connect through 2020-02-25. Authentication to the device is based on a username and password. The root credenti… |
CVE-2020-8296 | Medium | 6.7 | 2021-03-03 | Nextcloud Server prior to 20.0.0 stores passwords in a recoverable format even when external storage is not configured. |
CVE-2021-25309 | Critical | 9.8 | 2021-03-02 | The telnet administrator service running on port 650 on Gigaset DX600A v41.00-175 devices does not implement any lockout or throttling functionality. This situ… |
CVE-2020-25153 | Critical | 9.8 | 2020-12-23 | The built-in web service for MOXA NPort IAW5000A-I/O firmware version 2.1 or lower does not require users to have strong passwords. |
CVE-2020-29591 | Critical | 9.8 | 2020-12-11 | Versions of the Official registry Docker images through 2.7.0 contain a blank password for the root user. Systems deployed using affected versions of the regis… |
CVE-2020-26201 | Critical | 9.8 | 2020-12-10 | Askey AP5100W_Dual_SIG_1.01.097 and all prior versions use a weak password at the Operating System (rlx-linux) level. This allows an attacker to gain unauthori… |
CVE-2020-27587 | Medium | 6.7 | 2020-11-30 | Quick Heal Total Security before 19.0 allows attackers with local admin rights to obtain access to files in the File Vault via a brute-force attack on the pass… |
CVE-2020-27585 | Medium | 4.4 | 2020-11-30 | Quick Heal Total Security before 19.0 allows attackers with local admin rights to modify sensitive anti virus settings via a brute-attack on the settings passw… |
CVE-2020-8956 | Low | 3.3 | 2020-10-27 | Pulse Secure Desktop Client 9.0Rx before 9.0R5 and 9.1Rx before 9.1R4 on Windows reveals users' passwords if Save Settings is enabled. |
CVE-2019-17444 | Critical | 9.8 | 2020-10-12 | Jfrog Artifactory uses default passwords (such as "password") for administrative accounts and does not require users to change them. This may allow unauthorize… |
CVE-2020-15369 | High | 8.8 | 2020-09-25 | Supportlink CLI in Brocade Fabric OS Versions v8.2.1 through v8.2.1d, and 8.2.2 versions before v8.2.2c does not obfuscate the password field, which could expo… |
CVE-2020-26103 | High | 7.5 | 2020-09-25 | In cPanel before 88.0.3, an insecure site password is used for Mailman on a templated VM (SEC-551). |
CVE-2019-4698 | High | 7.5 | 2020-08-26 | IBM Security Guardium Data Encryption (GDE) 3.0.0.2 does not require that users should have strong passwords by default, which makes it easier for attackers to… |
CVE-2015-8033 | Medium | 5.3 | 2020-08-14 | In Textpattern 4.5.7, the password-reset feature does not securely tether a hash to a user account. |
CVE-2020-15115 | Medium | 5.8 | 2020-08-06 | etcd before versions 3.3.23 and 3.4.10 does not perform any password length validation, which allows for very short passwords, such as those with a length of o… |
CVE-2020-4574 | High | 7.5 | 2020-07-29 | IBM Tivoli Key Lifecycle Manager does not require that users should have strong passwords by default, which makes it easier for attackers to compromise user ac… |
CVE-2020-7519 | High | 7.5 | 2020-07-23 | A CWE-521: Weak Password Requirements vulnerability exists in Easergy Builder (Version 1.4.7.2 and older) which could allow an attacker to compromise a user ac… |
CVE-2020-11624 | Critical | 9.8 | 2020-07-23 | An issue was discovered in AvertX Auto focus Night Vision HD Indoor/Outdoor IP Dome Camera HD838 and Night Vision HD Indoor/Outdoor Mini IP Bullet Camera HD438… |
CVE-2016-11069 | High | 7.5 | 2020-06-19 | An issue was discovered in Mattermost Server before 3.2.0. It mishandles brute-force attempts at password change. |
CVE-2020-7492 | Medium | 6.5 | 2020-06-16 | A CWE-521: Weak Password Requirements vulnerability exists in the GP-Pro EX V1.00 to V4.09.100 which could cause the discovery of the password when the user is… |
CVE-2019-4576 | Critical | 9.8 | 2020-06-10 | IBM QRadar Network Packet Capture 7.3.0 - 7.3.3 Patch 1 and 7.4.0 GA does not require that users should have strong passwords by default, which makes it easier… |
CVE-2020-4245 | High | 7.5 | 2020-05-28 | IBM Security Identity Governance and Intelligence 5.2.6 does not require that users should have strong passwords by default, which makes it easier for attacker… |
CVE-2019-18872 | High | 7.5 | 2020-05-07 | Weak password requirements in Blaauw Remote Kiln Control through v3.00r4 allow a user to set short or guessable passwords (e.g., 1 or 1234). |
CVE-2020-8790 | Critical | 9.8 | 2020-05-04 | The OKLOK (3.1.1) mobile companion app for Fingerprint Bluetooth Padlock FB50 (2.3) has weak password requirements combined with improper restriction of excess… |