CWE-521 · Weak Password Requirements (page 3)
Page 3 of 3 — CVEs classified under CWE-521, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2017-18857 | Critical | 9.8 | 2020-04-28 | The NETGEAR Insight application before 2.42 for Android and iOS is affected by password mismanagement. |
CVE-2020-11966 | Critical | 9.8 | 2020-04-21 | In IQrouter through 3.3.1, the Lua function reset_password in the web-panel allows remote attackers to change the root password arbitrarily. Note: The vendor c… |
CVE-2019-19093 | Medium | 6.5 | 2020-04-02 | eSOMS versions 4.0 to 6.0.3 do not enforce password complexity settings, potentially resulting in lower access security due to insecure user passwords. |
CVE-2020-6991 | Critical | 9.8 | 2020-03-24 | In Moxa EDS-G516E Series firmware, Version 5.2 or lower, weak password requirements may allow an attacker to gain access using brute force. |
CVE-2020-6995 | Critical | 9.8 | 2020-03-24 | In Moxa PT-7528 series firmware, Version 4.0 or lower, and PT-7828 series firmware, Version 3.9 or lower, the application utilizes weak password requirements… |
CVE-2019-6558 | High | 7.5 | 2020-03-23 | In Auto-Maskin RP210E Versions 3.7 and prior, DCU210E Versions 3.7 and prior and Marine Observer Pro (Android App), the software contains a mechanism for users… |
CVE-2019-9096 | Critical | 9.8 | 2020-03-11 | An issue was discovered on Moxa MGate MB3170 and MB3270 devices before 4.1, MB3280 and MB3480 devices before 3.1, MB3660 devices before 2.3, and MB3180 devices… |
CVE-2020-9023 | Critical | 9.8 | 2020-02-17 | Iteris Vantage Velocity Field Unit 2.3.1 and 2.4.2 devices have two users that are not documented and are configured with weak passwords (User bluetooth, passw… |
CVE-2020-8988 | Medium | 5.9 | 2020-02-13 | The Voatz application 2020-01-01 for Android allows only 100 million different PINs, which makes it easier for attackers (after using root access to make a cop… |
CVE-2019-18988 | High | 7.0 | 2020-02-07 | TeamViewer Desktop through 14.7.1965 allows a bypass of remote-login access control because the same key is used for different customers' installations. It use… |
CVE-2020-8632 | Medium | 5.5 | 2020-02-05 | In cloud-init through 19.4, rand_user_password in cloudinit/config/cc_set_passwords.py has a small default pwlen value, which makes it easier for attackers to… |
CVE-2020-7940 | High | 7.5 | 2020-01-23 | Missing password strength checks on some forms in Plone 4.3 through 5.2.0 allow users to set weak passwords, leading to easier cracking. |
CVE-2019-7488 | Critical | 9.8 | 2019-12-23 | Weak default password cause vulnerability in SonicWall Email Security appliance which leads to attacker gain access to appliance database. This vulnerability a… |
CVE-2019-19747 | Critical | 9.8 | 2019-12-20 | NeuVector 3.1 when configured to allow authentication via Active Directory, does not enforce non-empty passwords which allows an attacker with access to the Ne… |
CVE-2019-19690 | Critical | 9.8 | 2019-12-18 | Trend Micro Mobile Security for Android (Consumer) versions 10.3.1 and below on Android 8.0+ has an issue in which an attacker could bypass the product's App P… |
CVE-2019-18828 | Medium | 6.8 | 2019-12-16 | Barco ClickShare Button R9861500D01 devices before 1.9.0 have Insufficiently Protected Credentials. The root account (present for access via debug interfaces… |
CVE-2019-14833 | Medium | 5.4 | 2019-11-06 | A flaw was found in Samba, all versions starting samba 4.5.0 before samba 4.9.15, samba 4.10.10, samba 4.11.2, in the way it handles a user password change or… |
CVE-2011-4931 | High | 7.5 | 2019-10-29 | gpw generates shorter passwords than required |
CVE-2019-4565 | High | 7.5 | 2019-09-20 | IBM Security Key Lifecycle Manager 3.0 and 3.0.1 does not require that users should have strong passwords by default, which makes it easier for attackers to co… |
CVE-2019-3758 | Critical | 9.8 | 2019-09-18 | RSA Archer, versions prior to 6.6 P2 (6.6.0.2), contain an improper authentication vulnerability. The vulnerability allows sysadmins to create user accounts wi… |
CVE-2019-13918 | Critical | 9.8 | 2019-09-13 | A vulnerability has been identified in SINEMA Remote Connect Server (All versions < V2.0 SP1). The web interface has no means to prevent password guessing atta… |
CVE-2019-4321 | High | 7.5 | 2019-09-05 | IBM Intelligent Operations Center V5.1.0 - V5.2.0, IBM Intelligent Operations Center for Emergency Management V5.1.0 - V5.1.0.6, and IBM Water Operations for W… |
CVE-2019-4235 | High | 7.5 | 2019-06-26 | IBM PureApplication System 2.2.3.0 through 2.2.5.3 does not require that users should have strong passwords by default, which makes it easier for attackers to… |
CVE-2019-4067 | High | 7.5 | 2019-06-07 | IBM Intelligent Operations Center (IOC) 5.1.0 through 5.2.0 does not require that users should have strong passwords by default, which makes it easier for atta… |
CVE-2019-9950 | Critical | 9.8 | 2019-04-24 | Western Digital My Cloud, My Cloud Mirror Gen2, My Cloud EX2 Ultra, My Cloud EX2100, My Cloud EX4100, My Cloud DL2100, My Cloud DL4100, My Cloud PR2100 and My… |
CVE-2018-1680 | Medium | 5.9 | 2019-04-02 | IBM Security Privileged Identity Manager Virtual Appliance 2.2.1 does not require that users should have strong passwords by default, which makes it easier for… |
CVE-2019-9123 | Critical | 9.8 | 2019-02-25 | An issue was discovered on D-Link DIR-825 Rev.B 2.10 devices. The "user" account has a blank password. |
CVE-2019-7676 | High | 7.2 | 2019-02-09 | A weak password vulnerability was discovered in Enphase Envoy R3.*.*. One can login via TCP port 8888 with the admin password for the admin account. |
CVE-2019-7674 | Critical | 9.8 | 2019-02-09 | An issue was discovered on MOBOTIX S14 MX-V4.2.1.61 devices. /admin/access accepts a request to set the "aaaaa" password, considered insecure for some use case… |
CVE-2018-1956 | Medium | 5.9 | 2019-01-14 | IBM Security Identity Manager 6.0.0 does not require that users should have strong passwords by default, which makes it easier for attackers to compromise user… |
CVE-2017-1597 | Medium | 5.9 | 2018-12-17 | IBM Security Guardium 10.0, 10.0.1, 10.1, 10.1.2, 10.1.3, 10.1.4, and 10.5 Database Activity Monitor does not require that users should have strong passwords b… |
CVE-2018-15719 | Critical | 9.8 | 2018-12-12 | Open Dental before version 18.4 installs a mysql database and uses the default credentials of "root" with a blank password. This allows anyone on the network w… |
CVE-2018-18562 | High | 8.8 | 2018-11-20 | An issue was discovered in Roche Accu-Chek Inform II Base Unit / Base Unit Hub before 03.01.04 and CoaguChek / cobas h232 Handheld Base Unit before 03.01.04. W… |
CVE-2018-17906 | High | 8.8 | 2018-11-19 | Philips iSite and IntelliSpace PACS, iSite PACS, all versions, and IntelliSpace PACS, all versions. Default credentials and no authentication within third part… |
CVE-2018-19064 | Critical | 9.8 | 2018-11-07 | An issue was discovered on Foscam C2 devices with System Firmware 1.11.1.8 and Application Firmware 2.72.1.32, and Opticam i5 devices with System Firmware 1.5… |
CVE-2018-15766 | High | 7.5 | 2018-10-11 | On install, Dell Encryption versions prior 10.0.1 and Dell Endpoint Security Suite Enterprise versions prior 2.0.1 will overwrite and manually set the "Minimum… |
CVE-2018-16703 | Medium | 5.3 | 2018-09-07 | A vulnerability in the Gleez CMS 1.2.0 login page could allow an unauthenticated, remote attacker to perform multiple user enumerations, which can further help… |
CVE-2018-5389 | Medium | 5.9 | 2018-09-06 | The Internet Key Exchange v1 main mode is vulnerable to offline dictionary or brute force attacks. Reusing a key pair across different versions and modes of IK… |
CVE-2017-9818 | High | 7.5 | 2018-08-24 | The National Payments Corporation of India BHIM application 1.3 for Android relies on a four-digit passcode, which makes it easier for attackers to obtain acce… |
CVE-2018-15748 | High | 8.8 | 2018-08-23 | On Dell 2335dn printers with Printer Firmware Version 2.70.05.02, Engine Firmware Version 1.10.65, and Network Firmware Version V4.02.15(2335dn MFP) 11-22-2010… |
CVE-2018-12925 | Critical | 9.8 | 2018-06-28 | Baseon Lantronix MSS devices do not require a password for TELNET access. |
CVE-2018-1101 | High | 7.2 | 2018-05-02 | Ansible Tower before version 3.2.4 has a flaw in the management of system and organization administrators that allows for privilege escalation. System administ… |
CVE-2017-1601 | Critical | 9.8 | 2018-05-02 | IBM Security Guardium 10.0, 10.0.1, and 10.1 through 10.1.4 Database Activity Monitor does not require that users should have strong passwords by default, whic… |
CVE-2018-1000134 | Critical | 9.8 | 2018-03-16 | UnboundID LDAP SDK version from commit 801111d8b5c732266a5dbd4b3bb0b6c7b94d7afb up to commit 8471904a02438c03965d21367890276bc25fa5a6, where the issue was repo… |
CVE-2018-6312 | High | 7.2 | 2018-03-10 | A privileged account with a weak default password on the Foxconn femtocell FEMTO AP-FC4064-T version AP_GT_B38_5.8.3lb15-W47 LTE Build 15 can be used to turn o… |
CVE-2018-1372 | Critical | 9.8 | 2018-02-27 | IBM Security Guardium Big Data Intelligence (SonarG) 3.1 does not require that users should have strong passwords by default, which makes it easier for attacke… |
CVE-2018-0204 | High | 7.5 | 2018-02-22 | A vulnerability in the web portal of the Cisco Prime Collaboration Provisioning Tool could allow an unauthenticated, remote attacker to create a denial of serv… |
CVE-2017-16727 | Critical | 9.1 | 2017-12-22 | A Credentials Management issue was discovered in Moxa NPort W2150A versions prior to 1.11, and NPort W2250A versions prior to 1.11. The default password is emp… |
CVE-2017-3186 | Critical | 9.8 | 2017-12-16 | ACTi cameras including the D, B, I, and E series using firmware version A1D-500-V6.11.31-AC use non-random default credentials across all devices. A remote att… |
CVE-2017-14189 | Critical | 9.8 | 2017-11-29 | An improper access control vulnerability in Fortinet FortiWebManager 5.8.0 allows anyone that can access the admin webUI to successfully log-in regardless the… |
CVE-2017-1221 | Critical | 9.8 | 2017-11-13 | IBM Tivoli Endpoint Manager (IBM BigFix 9.2 and 9.5) does not require that users should have strong passwords by default, which makes it easier for attackers t… |
CVE-2017-7150 | Medium | 5.5 | 2017-10-23 | An issue was discovered in certain Apple products. macOS before 10.13 Supplemental Update is affected. The issue involves the "Security" component. It allows a… |
CVE-2017-12861 | Critical | 9.8 | 2017-10-10 | The Epson "EasyMP" software is designed to remotely stream a users computer to supporting projectors.These devices are authenticated using a unique 4-digit cod… |
CVE-2017-9853 | Critical | 9.8 | 2017-08-05 | An issue was discovered in SMA Solar Technology products. All inverters have a very weak password policy for the user and installer password. No complexity req… |
CVE-2017-1386 | Medium | 5.9 | 2017-07-31 | IBM API Connect 5.0.0.0 could allow a user to bypass policy restrictions and create non-compliant passwords which could be intercepted and decrypted using man… |
CVE-2017-7903 | Critical | 9.8 | 2017-06-30 | A Weak Password Requirements issue was discovered in Rockwell Automation Allen-Bradley MicroLogix 1100 programmable-logic controllers 1763-L16AWA, Series A and… |
CVE-2017-1196 | Critical | 9.8 | 2017-06-07 | IBM BigFix Compliance (TEMA SUAv1 SCA SCM) 1.9.70 does not require that users should have strong passwords by default, which makes it easier for attackers to c… |
CVE-2017-6339 | Medium | 6.5 | 2017-04-05 | Trend Micro InterScan Web Security Virtual Appliance (IWSVA) 6.5 before CP 1746 mismanages certain key and certificate data. Per IWSVA documentation, by defaul… |
CVE-2017-7306 | Medium | 6.4 | 2017-04-04 | Riverbed RiOS through 9.6.0 has a weak default password for the secure vault, which makes it easier for physically proximate attackers to defeat the secure-vau… |
CVE-2017-7305 | Medium | 4.6 | 2017-04-04 | Riverbed RiOS through 9.6.0 does not require a bootloader password, which makes it easier for physically proximate attackers to defeat the secure-vault protect… |
CVE-2012-2441 | | 2012-04-28 | RuggedCom Rugged Operating System (ROS) before 3.3 has a factory account with a password derived from the MAC Address field in a banner, which makes it easier… |