Weakness (CWE)
CWE-255: Credentials Management Errors
Weaknesses in this category are related to the management of credentials.
Source: MITRE CWE-255
63 results · Feed
-
High 7.0
Improper Credential Storage in Symphony Plus
In S+ Operations and S+ Historian, the passwords of internal users (not Windows Users) are encrypted but improperly stored in a database.
-
Critical 9.8
Cisco Prime License Manager Privilege Escalation Vulnerability
A vulnerability in the web management interface of Cisco Prime License Manager (PLM) Software could allow an unauthenticated, remote attacker to gain unauthorized access to an affected device. The vulnerability is due to insufficient validation of user input …
-
Critical 9.1
RVD#3326: Hardcoded default credentials on IRC 5 OPC Server
The IRC5 family with UAS service enabled comes by default with credentials that can be found on publicly available manuals. ABB considers this a well documented functionality that helps customer set up however, out of our research, we found multiple productio…
-
Medium 5.8
VM-Series on Microsoft Azure: Inadvertent collection of credentials in Tech support files on HA configured VMs
TechSupport files generated on Palo Alto Networks VM Series firewalls for Microsoft Azure platform configured with high availability (HA) inadvertently collect Azure dashboard service account credentials. These credentials are equivalent to the credentials as…
-
High 8.4
Cisco IOS XE SD-WAN Software Default Credentials Vulnerability
A vulnerability in Cisco IOS XE SD-WAN Software could allow an unauthenticated, local attacker to gain unauthorized access to an affected device. The vulnerability is due to the existence of default credentials within the default configuration of an affected …
-
Unscored —
Weak default password cause vulnerability in SonicWall Email Security appliance which leads to attacker gain access to …
-
Unscored —
A Credentials Management CWE-255 vulnerability exists in the APC UPS Network Management Card 2 AOS v6.5.6, which could …
-
Unscored —
A CWE-255 Credentials Management vulnerability exists in Modicon Quantum with firmware versions prior to V2.40. which c…
-
Medium 5.8
Cisco Adaptive Security Appliance Software and Firepower Threat Defense Software VPN SAML Authentication Bypass Vulnerability
A vulnerability in the implementation of Security Assertion Markup Language (SAML) 2.0 Single Sign-On (SSO) for Clientless SSL VPN (WebVPN) and AnyConnect Remote Access VPN in Cisco Adaptive Security Appliance (ASA) Software and Cisco Firepower Threat Defense…
-
High 7.8
Cisco Aironet Series Access Points Development Shell Access Vulnerability
A vulnerability in the development shell (devshell) authentication for Cisco Aironet Series Access Points (APs) running the Cisco AP-COS operating system could allow an authenticated, local attacker to access the development shell without proper authenticatio…
-
Unscored —
Rockwell PLC5/SLC5/0x/RSLogix Credentials management
The potential exists for exposure of the product's password used to restrict unauthorized access to Rockwell PLC5/SLC5/0x/RSLogix 1785-Lx and 1747-L5x controllers. The potential exists for an unauthorized programming and configuration client to gain access to…
-
Unscored —
Open Dental before version 18.4 installs a mysql database and uses the default credentials of "root" with a blank passw…
-
Unscored —
Cisco Prime Collaboration Provisioning Intermittent Hard-Coded Password Vulnerability
A vulnerability in the install function of Cisco Prime Collaboration Provisioning (PCP) could allow an unauthenticated, remote attacker to access the administrative web interface using a default hard-coded username and password that are used during install. T…
-
Unscored —
Nuuo NT-4040 Titan, firmware NT-4040_01.07.0000.0015_1120, uses default credentials
Nuuo NT-4040 Titan, firmware NT-4040_01.07.0000.0015_1120, uses non-random default credentials of: admin:admin and localdisplay:111111. A remote network attacker can gain privileged access to a vulnerable device.
-
Unscored —
Green Packet DX-350 uses default credentials
Green Packet DX-350 uses non-random default credentials of: root:wimax. A remote network attacker can gain privileged access to a vulnerable device.
-
Unscored —
Intellian Satellite TV antennas t-Series and v-Series, firmware version 1.07, uses default credentials
Intellian Satellite TV antennas t-Series and v-Series, firmware version 1.07, uses non-random default credentials of: ftp/ftp or intellian:12345678. A remote network attacker can gain elevated access to a vulnerable device.
-
Unscored —
Synology NAS servers DS107, DS116, and DS213, use default credentials
Synology NAS servers DS107, firmware version 3.1-1639 and prior, and DS116, DS213, firmware versions prior to 5.2-5644-1, use non-random default credentials of: guest:(blank) and admin:(blank) . A remote network attacker can gain privileged access to a vulner…
-
Unscored —
A vulnerability in the password recovery function of Cisco Prime Collaboration Provisioning (PCP) could allow an unauth…
-
Unscored —
A vulnerability in the password reset function of Cisco Prime Collaboration Provisioning (PCP) could allow an unauthent…
-
Unscored —
A vulnerability in the assignment and management of default user accounts for Secure Shell (SSH) access to Cisco Airone…
-
Unscored —
A Credentials Management issue was discovered in Moxa NPort W2150A versions prior to 1.11, and NPort W2250A versions pr…
-
Unscored —
Wi-Fi STATION L-02F Software version V10g and earlier allows remote attackers to access the device with administrative …
-
Unscored —
A vulnerability in Cisco Aironet 1830 Series and Cisco Aironet 1850 Series Access Points running Cisco Mobility Express…