Overview 268 matches · 4 in Waratek scope · 0 protected · 2 exploited · 1 CISA KEV · 4 public PoC · 1 EPSS ≥ 0.5
268matches
4in Waratek scope1.5%
0protected0.0%
2exploited0.7%
1CISA KEV0.4%
4public PoC1.5%
1EPSS ≥ 0.50.4%
Protected by Waratek
0
0.0%
Rule in development
0
0.0%
Mitigation candidate
0
0.0%
No exploit published
4
1.5%
Outside Waratek scope
2
0.7%
Not applicable
262
97.8%
Withdrawn CVE
0
0.0%
blocked by ARMR today
0
0.0%
partly blocked
0
0.0%
not blocked
268
100.0%
not established
0
0.0%
unrecorded
0
0.0%
split by
peak 47 / year
20121
Not applicable1
High1
not blocked1
Working exploit published1
20130
20140
20150
20160
201713
Not applicable13
Critical8
Medium5
not blocked13
Working exploit published1
No public exploit12
201817
No exploit published1
Not applicable16
Critical6
High9
Medium2
not blocked17
No public exploit17
201918
Not applicable18
Critical8
High8
Medium2
not blocked18
No public exploit18
202033
Not applicable33
Critical13
High12
Medium7
Low1
not blocked33
Exploited1
Working exploit published1
No public exploit31
202120
Outside Waratek scope2
Not applicable18
Critical10
High6
Medium4
not blocked20
No public exploit20
202232
Not applicable32
Critical15
High13
Medium3
Low1
not blocked32
Proof of concept only4
No public exploit28
202331
No exploit published1
Not applicable30
Critical13
High16
Medium2
not blocked31
Proof of concept only9
No public exploit22
202432
No exploit published1
Not applicable31
Critical4
High13
Medium13
Low2
not blocked32
Working exploit published1
Proof of concept only9
No public exploit22
202547
No exploit published1
Not applicable46
Critical15
High13
Medium14
Low5
not blocked47
Exploited1
Proof of concept only15
No public exploit31
202624
Not applicable24
Critical9
High6
Medium5
Low4
not blocked24
Proof of concept only3
No public exploit21
20122014201620182020202220242026
| CVE | Severity | Published▾ | Status | Exploitation | Description |
|---|---|---|---|---|---|
| CVE-2024-0347 | Low | 2024-01-09 | Not applicable | Proof of concept only | A vulnerability was found in SourceCodester Engineers Online Portal 1.0 and classified as problematic. This issue affects some unknown processing of the file signup_teacher.php. The manipulation of the argument Password leads to weak password requirements. The attack may be initiated remotely. The complexity of an attack is rather high. The exploitation is known to be difficult. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-250115. |
| CVE-2023-49238 | Critical | 2024-01-09 | Not applicable | No public exploit | In Gradle Enterprise before 2023.1, a remote attacker may be able to gain access to a new installation (in certain installation scenarios) because of a non-unique initial system user password. Although this password must be changed upon the first login, it is possible that an attacker logs in before the legitimate administrator logs in. |
| CVE-2024-0188 | High | 2024-01-02 | Not applicable | No public exploit | A vulnerability, which was classified as problematic, was found in RRJ Nueva Ecija Engineer Online Portal 1.0. This affects an unknown part of the file change_password_teacher.php. The manipulation leads to weak password requirements. It is possible to initiate the attack remotely. The complexity of an attack is rather high. The exploitability is told to be difficult. The exploit has been disclosed to the public and may be used. The identifier VDB-249501 was assigned to this vulnerability. |
| CVE-2023-7053 | High | 2023-12-22 | Not applicable | No public exploit | A vulnerability was found in PHPGurukul Online Notes Sharing System 1.0. It has been declared as problematic. This vulnerability affects unknown code of the file /user/signup.php. The manipulation leads to weak password requirements. The attack can be initiated remotely. The complexity of an attack is rather high. The exploitation appears to be difficult. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-248740. |
| CVE-2023-24049 | Critical | 2023-12-04 | Not applicable | No public exploit | An issue was discovered on Connectize AC21000 G6 641.139.1.1256 allows attackers to gain escalated privileges on the device via poor credential management. |
| CVE-2023-29974 | Critical | 2023-11-08 | Not applicable | No public exploit | An issue discovered in Pfsense CE version 2.6.0 allows attackers to compromise user accounts via weak password requirements. |
| CVE-2023-41353 | High | 2023-11-03 | Not applicable | No public exploit | Chunghwa Telecom NOKIA G-040W-Q has a vulnerability of weak password requirements. A remote attacker with regular user privilege can easily infer the administrator password from system information after logging system, resulting in admin access and performing arbitrary system operations or disrupt service. |
| CVE-2023-37503 | Critical | 2023-10-19 | Not applicable | No public exploit | HCL Compass is vulnerable to insecure password requirements. An attacker could easily guess the password and gain access to user accounts. |
| CVE-2023-37756 | Critical | 2023-09-14 | Not applicable | Proof of concept only | I-doit pro 25 and below and I-doit open 25 and below employ weak password requirements for Administrator account creation. Attackers are able to easily guess users' passwords via a bruteforce attack. |
| CVE-2023-40707 | High | 2023-08-24 | Not applicable | No public exploit | There are no requirements for setting a complex password in the built-in web server of the SNAP PAC S1 Firmware version R10.3b, which could allow for a successful brute force attack if users don't set up complex credentials. |
| CVE-2023-4125 | High | 2023-08-03 | Not applicable | Proof of concept only | Weak Password Requirements in GitHub repository answerdev/answer prior to v1.1.0. |
| CVE-2023-34995 | Critical | 2023-07-07 | Not applicable | No public exploit | There are no requirements for setting a complex password for PiiGAB M-Bus, which could contribute to a successful brute force attack if the password is inline with recommended password guidelines. |
| CVE-2023-3089 | High | 2023-07-05 | Not applicable | No public exploit | A compliance problem was found in the Red Hat OpenShift Container Platform. Red Hat discovered that, when FIPS mode was enabled, not all of the cryptographic modules in use were FIPS-validated. |
| CVE-2023-34240 | Critical | 2023-06-27 | Not applicable | No public exploit | Cloudexplorer-lite is an open source cloud software stack. Weak passwords can be easily guessed and are an easy target for brute force attacks. This can lead to an authentication system failure and compromise system security. Versions of cloudexplorer-lite prior to 1.2.0 did not enforce strong passwords. This vulnerability has been fixed in version 1.2.0. Users are advised to upgrade. There are no known workarounds for this vulnerability. |
| CVE-2023-3423 | High | 2023-06-27 | Not applicable | No public exploit | Weak Password Requirements in GitHub repository cloudexplorer-dev/cloudexplorer-lite prior to v 1.2.0. |
| CVE-2023-2060 | High | 2023-06-02 | Not applicable | No public exploit | Weak Password Requirements vulnerability in FTP function on Mitsubishi Electric Corporation MELSEC iQ-R Series EtherNet/IP module RJ71EIP91 and MELSEC iQ-F Series EtherNet/IP module FX5-ENET/IP allows a remote unauthenticated attacker to access to the module via FTP by dictionary attack or password sniffing. |
| CVE-2023-31098 | Critical | 2023-05-22 | No exploit published | No public exploit | Weak Password Requirements vulnerability in Apache Software Foundation Apache InLong.This issue affects Apache InLong: from 1.1.0 through 1.6.0. When users change their password to a simple password (with any character or symbol), attackers can easily guess the user's password and access the account. Users are advised to upgrade to Apache InLong's 1.7.0 or cherry-pick https://github.com/apache/inlong/pull/7805 https://github.com/apache/inlong/pull/7805 to solve it. |
| CVE-2023-25184 | High | 2023-05-10 | Not applicable | No public exploit | Use of weak credentials exists in Seiko Solutions SkyBridge and SkySpider series, which may allow a remote unauthenticated attacker to decrypt password for the WebUI of the product. Affected products and versions are as follows: SkyBridge MB-A200 firmware Ver. 01.00.05 and earlier, SkyBridge BASIC MB-A130 firmware Ver. 1.4.1 and earlier, and SkySpider MB-R210 firmware Ver. 1.01.00 and earlier. |
| CVE-2023-25072 | High | 2023-05-10 | Not applicable | No public exploit | Use of weak credentials exists in SkyBridge MB-A100/110 firmware Ver. 4.2.0 and earlier, which may allow a remote unauthenticated attacker to decrypt password for the WebUI of the product. |
| CVE-2023-31043 | High | 2023-04-23 | Not applicable | No public exploit | EnterpriseDB EDB Postgres Advanced Server (EPAS) before 14.6.0 logs unredacted passwords in situations where optional parameters are used with CREATE/ALTER USER/GROUP/ROLE, and redacting was configured with edb_filter_log.redact_password_commands. The fixed versions are 10.23.33, 11.18.29, 12.13.17, 13.9.13, and 14.6.0. |
| CVE-2023-2160 | Critical | 2023-04-18 | Not applicable | Proof of concept only | Weak Password Requirements in GitHub repository modoboa/modoboa prior to 2.1.0. |
| CVE-2023-24502 | High | 2023-04-17 | Not applicable | No public exploit | Electra Central AC unit – The unit opens an AP with an easily calculated password. |
| CVE-2023-2106 | Critical | 2023-04-15 | Not applicable | Proof of concept only | Weak Password Requirements in GitHub repository janeczku/calibre-web prior to 0.6.20. |
| CVE-2022-34333 | High | 2023-04-07 | Not applicable | No public exploit | IBM Sterling Order Management 10.0 does not require that users should have strong passwords by default, which makes it easier for attackers to compromise user accounts. IBM X-Force ID: 229698. |
| CVE-2023-1753 | Critical | 2023-03-31 | Not applicable | No public exploit | Weak Password Requirements in GitHub repository thorsten/phpmyfaq prior to 3.1.12. |
| CVE-2022-45635 | High | 2023-03-21 | Not applicable | Proof of concept only | An issue discovered in MEGAFEIS, BOFEI DBD+ Application for IOS & Android v1.4.4 allows attacker to gain access to sensitive account information via insecure password policy. |
| CVE-2021-36689 | Medium | 2023-03-04 | Not applicable | No public exploit | An issue discovered in com.samourai.wallet.PinEntryActivity.java in Streetside Samourai Wallet 0.99.96i allows attackers to view sensitive information and decrypt data via a brute force attack that uses a recovered samourai.dat file. The PIN is 5 to 8 digits, which may be insufficient in this situation. |
| CVE-2023-0793 | High | 2023-02-12 | Not applicable | Proof of concept only | Weak Password Requirements in GitHub repository thorsten/phpmyfaq prior to 3.1.11. |
| CVE-2023-0641 | Critical | 2023-02-02 | Not applicable | No public exploit | A vulnerability was found in PHPGurukul Employee Leaves Management System 1.0. It has been declared as problematic. Affected by this vulnerability is an unknown functionality of the file changepassword.php. The manipulation of the argument newpassword/confirmpassword leads to weak password requirements. The attack can be launched remotely. The complexity of an attack is rather high. The exploitation appears to be difficult. The exploit has been disclosed to the public and may be used. The identifier VDB-220021 was assigned to this vulnerability. |
| CVE-2022-32513 | Critical | 2023-01-30 | Not applicable | No public exploit | A CWE-521: Weak Password Requirements vulnerability exists that could allow an attacker to gain control of the device when the attacker brute forces the password. Affected Products: C-Bus Network Automation Controller - LSS5500NAC (Versions prior to V1.10.0), Wiser for C-Bus Automation Controller - LSS5500SHAC (Versions prior to V1.10.0), Clipsal C-Bus Network Automation Controller - 5500NAC (Versions prior to V1.10.0), Clipsal Wiser for C-Bus Automation Controller - 5500SHAC (Versions prior to V1.10.0), SpaceLogic C-Bus Network Automation Controller - 5500NAC2 (Versions prior to V1.10.0), SpaceLogic C-Bus Application Controller - 5500AC2 (Versions prior to V1.10.0) |
| CVE-2023-0569 | Medium | 2023-01-29 | Not applicable | Proof of concept only | Weak Password Requirements in GitHub repository publify/publify prior to 9.2.10. |
| CVE-2023-0564 | High | 2023-01-29 | Not applicable | Proof of concept only | Weak Password Requirements in GitHub repository froxlor/froxlor prior to 2.0.10. |
| CVE-2023-0307 | Critical | 2023-01-15 | Not applicable | Proof of concept only | Weak Password Requirements in GitHub repository thorsten/phpmyfaq prior to 3.1.10. |
| CVE-2023-22451 | High | 2023-01-02 | Not applicable | No public exploit | Kiwi TCMS is an open source test management system. In version 11.6 and prior, when users register new accounts and/or change passwords, there is no validation in place which would prevent them from picking an easy to guess password. This issue is resolved by providing defaults for the `AUTH_PASSWORD_VALIDATORS` configuration setting. As of version 11.7, the password can’t be too similar to other personal information, must contain at least 10 characters, can’t be a commonly used password, and can’t be entirely numeric. As a workaround, an administrator may reset all passwords in Kiwi TCMS if they think a weak password may have been chosen. |
| CVE-2022-44236 | Critical | 2022-12-15 | Not applicable | Proof of concept only | Beijing Zed-3 Technologies Co.,Ltd VoIP simpliclty ASG 8.5.0.17807 (20181130-16:12) has a Weak password vulnerability. |
| CVE-2021-39434 | High | 2022-12-06 | Not applicable | No public exploit | A default username and password for an administrator account was discovered in ZKTeco ZKTime 10.0 through 11.1.0, builds 20180901, 20190510.1, 20200309.3, 20200930, 20201231, and 20210220. |
| CVE-2022-45482 | Critical | 2022-12-02 | Not applicable | No public exploit | Lazy Mouse server enforces weak password requirements and doesn't implement rate limiting, allowing remote unauthenticated users to easily and quickly brute force the PIN and execute arbitrary commands. CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
| CVE-2022-41969 | Low | 2022-12-01 | Not applicable | No public exploit | Nextcloud Server is an open source personal cloud server. Prior to versions 23.0.11, 24.0.7, and 25.0.0, there is no password length limit when creating a user as an administrator. An administrator can cause a limited DoS attack against their own server. Versions 23.0.11, 24.0.7, and 25.0.0 contain a fix for the issue. As a workaround, don't create user accounts with long passwords. |
| CVE-2022-43030 | High | 2022-11-14 | Not applicable | Proof of concept only | Siyucms v6.1.7 was discovered to contain a remote code execution (RCE) vulnerability in the background. SIYUCMS is a content management system based on ThinkPaP5 AdminLTE. SIYUCMS has a background command execution vulnerability, which can be used by attackers to gain server privileges |
| CVE-2022-3754 | Critical | 2022-10-29 | Not applicable | Proof of concept only | Weak Password Requirements in GitHub repository thorsten/phpmyfaq prior to 3.1.8. |
| CVE-2022-3376 | Medium | 2022-10-06 | Not applicable | No public exploit | Weak Password Requirements in GitHub repository ikus060/rdiffweb prior to 2.5.0a4. |
| CVE-2022-3326 | Medium | 2022-09-29 | Not applicable | Proof of concept only | Weak Password Requirements in GitHub repository ikus060/rdiffweb prior to 2.4.9. |
| CVE-2022-3268 | Critical | 2022-09-22 | Not applicable | No public exploit | Weak Password Requirements in GitHub repository ikus060/minarca prior to 4.2.2. |
| CVE-2022-3179 | High | 2022-09-13 | Not applicable | No public exploit | Weak Password Requirements in GitHub repository ikus060/rdiffweb prior to 2.4.2. |
| CVE-2022-27558 | High | 2022-08-29 | Not applicable | No public exploit | HCL iNotes is susceptible to a Broken Password Strength Checks vulnerability. Custom password policies are not enforced on certain iNotes forms which could allow users to set weak passwords, leading to easier cracking. |
| CVE-2022-37158 | Critical | 2022-08-25 | Not applicable | No public exploit | RuoYi v3.8.3 has a Weak password vulnerability in the management system. |
| CVE-2022-34772 | High | 2022-08-22 | Not applicable | No public exploit | Tabit - password enumeration. Description: Tabit - password enumeration. The passwords for the Tabit system is a 4 digit OTP. One can resend OTP and try logging in indefinitely. Once again, this is an example of OWASP: API4 - Rate limiting. |
| CVE-2022-2927 | Critical | 2022-08-22 | Not applicable | No public exploit | Weak Password Requirements in GitHub repository notrinos/notrinoserp prior to 0.7. |
| CVE-2022-34615 | Critical | 2022-08-19 | Not applicable | No public exploit | Mealie 1.0.0beta3 employs weak password requirements which allows attackers to potentially gain unauthorized access to the application via brute-force attacks. |
| CVE-2022-35280 | Critical | 2022-08-10 | Not applicable | No public exploit | IBM Robotic Process Automation 21.0.0, 21.0.1, and 21.0.2 does not require that users should have strong passwords by default, which makes it easier for attackers to compromise user accounts. IBM X-Force ID: 230634. |
| CVE-2022-35143 | Critical | 2022-08-04 | Not applicable | No public exploit | Renato v0.17.0 employs weak password complexity requirements, allowing attackers to crack user passwords via brute-force attacks. |
| CVE-2022-36301 | Critical | 2022-08-01 | Not applicable | No public exploit | BF-OS version 3.x up to and including 3.83 do not enforce strong passwords which may allow a remote attacker to brute-force the device password. |
| CVE-2022-26117 | High | 2022-07-18 | Not applicable | No public exploit | An empty password in configuration file vulnerability [CWE-258] in FortiNAC version 8.3.7 and below, 8.5.2 and below, 8.5.4, 8.6.0, 8.6.5 and below, 8.7.6 and below, 8.8.11 and below, 9.1.5 and below, 9.2.3 and below may allow an authenticated attacker to access the MySQL databases via the CLI. |
| CVE-2022-31211 | Critical | 2022-07-17 | Not applicable | No public exploit | An issue was discovered in Infiray IRAY-A8Z3 1.0.957. There is a blank root password for TELNET by default. |
| CVE-2022-28377 | High | 2022-07-14 | Not applicable | No public exploit | On Verizon 5G Home LVSKIHP InDoorUnit (IDU) 3.4.66.162 and OutDoorUnit (ODU) 3.33.101.0 devices, the CRTC and ODU RPC endpoints rely on a static account username/password for access control. This password can be generated via a binary included in the firmware, after ascertaining the MAC address of the IDU's base Ethernet interface, and adding the string DEVICE_MANUFACTURER='Wistron_NeWeb_Corp.' to /etc/device_info to replicate the host environment. This occurs in /etc/init.d/wnc_factoryssidkeypwd (IDU). |
| CVE-2022-1668 | Critical | 2022-06-24 | Not applicable | No public exploit | Weak default root user credentials allow remote attackers to easily obtain OS superuser privileges over the open TCP port for SSH. |
| CVE-2022-30325 | High | 2022-06-16 | Not applicable | No public exploit | An issue was found on TRENDnet TEW-831DR 1.0 601.130.1.1356 devices. The default pre-shared key for the Wi-Fi networks is the same for every router except for the last four digits. The device default pre-shared key for both 2.4 GHz and 5 GHz networks can be guessed or brute-forced by an attacker within range of the Wi-Fi network. |
| CVE-2022-2098 | Critical | 2022-06-16 | Not applicable | No public exploit | Weak Password Requirements in GitHub repository kromitgmbh/titra prior to 0.78.1. |
| CVE-2022-29729 | High | 2022-06-02 | Not applicable | No public exploit | Verizon 4G LTE Network Extender GA4.38 - V0.4.038.2131 utilizes a weak default admin password generation algorithm which generates passwords that are accessible to unauthenticated attackers via the webUI login page. |
| CVE-2022-29098 | High | 2022-06-01 | Not applicable | No public exploit | Dell PowerScale OneFS versions 8.2.0.x through 9.3.0.x, contain a weak password requirement vulnerability. An administrator may create an account with no password. A remote attacker may potentially exploit this leading to a user account compromise. |
| CVE-2022-1775 | Critical | 2022-05-20 | Not applicable | No public exploit | Weak Password Requirements in GitHub repository polonel/trudesk prior to 1.2.2. |
| CVE-2022-29700 | High | 2022-04-27 | Not applicable | No public exploit | A lack of password length restriction in Zammad v5.1.0 allows for the creation of extremely long passwords which can cause a Denial of Service (DoS) during password verification. |
| CVE-2022-1039 | Critical | 2022-04-20 | Not applicable | No public exploit | The weak password on the web user interface can be exploited via HTTP or HTTPS. Once such access has been obtained, the other passwords can be changed. The weak password on Linux accounts can be accessed via SSH or Telnet, the former of which is by default enabled on trusted interfaces. While the SSH service does not support root login, a user logging in using either of the other Linux accounts may elevate to root access using the su command if they have access to the associated password. |
| CVE-2022-1236 | Medium | 2022-04-05 | Not applicable | No public exploit | Weak Password Requirements in GitHub repository weseek/growi prior to v5.0.0. |
| CVE-2021-38935 | High | 2022-02-18 | Not applicable | No public exploit | IBM Maximo Asset Management 7.6.1.2 does not require that users should have strong passwords by default, which makes it easier for attackers to compromise user accounts. IBM X-Force ID: 210892. |
| CVE-2022-22110 | High | 2022-01-05 | Not applicable | No public exploit | In Daybyday CRM, versions 1.1 through 2.2.0 enforce weak password requirements in the user update functionality. A user with privileges to update his password could change it to a weak password, such as those with a length of a single character. This may allow an attacker to brute-force users’ passwords with minimal to no computational effort. |
| CVE-2021-41696 | Medium | 2021-12-09 | Not applicable | No public exploit | An authentication bypass (account takeover) vulnerability exists in Premiumdatingscript 4.2.7.7 due to a weak password reset mechanism in requests\user.php. |
| CVE-2021-43471 | High | 2021-12-06 | Not applicable | No public exploit | In Canon LBP223 printers, the System Manager Mode login does not require an account password or PIN. An attacker can remotely shut down the device after entering the background, creating a denial of service vulnerability. |
| CVE-2021-43036 | Critical | 2021-12-06 | Not applicable | No public exploit | An issue was discovered in Kaseya Unitrends Backup Appliance before 10.5.5. The password for the PostgreSQL wguest account is weak. |
| CVE-2021-20470 | High | 2021-12-03 | Outside Waratek scope | No public exploit | IBM Cognos Analytics 11.1.7 and 11.2.0 does not require that users should have strong passwords by default, which makes it easier for attackers to compromise user accounts. IBM X-Force ID: 196339. |
| CVE-2021-40333 | Critical | 2021-12-02 | Not applicable | No public exploit | Weak Password Requirements vulnerability in Hitachi Energy FOX61x, XCM20 allows an attacker to gain unauthorized access to the Data Communication Network (DCN) routing configuration. This issue affects: Hitachi Energy FOX61x versions prior to R15A. Hitachi Energy XCM20 versions prior to R15A. |
| CVE-2021-40520 | Critical | 2021-11-10 | Not applicable | No public exploit | Airangel HSMX Gateway devices through 5.2.04 have Weak SSH Credentials. |
| CVE-2021-38462 | Critical | 2021-10-19 | Not applicable | No public exploit | InHand Networks IR615 Router's Versions 2.3.0.r4724 and 2.3.0.r4870 does not enforce an efficient password policy. This may allow an attacker with obtained user credentials to enumerate passwords and impersonate other application users and perform operations on their behalf. |
| CVE-2021-35498 | Critical | 2021-10-13 | Not applicable | No public exploit | The TIBCO EBX Web Server component of TIBCO Software Inc.'s TIBCO EBX, TIBCO EBX, TIBCO EBX, and TIBCO Product and Service Catalog powered by TIBCO EBX contains a vulnerability that under certain specific conditions allows an attacker to enter a password other than the legitimate password and it will be accepted as valid. Affected releases are TIBCO Software Inc.'s TIBCO EBX: versions 5.8.123 and below, TIBCO EBX: versions 5.9.3, 5.9.4, 5.9.5, 5.9.6, 5.9.7, 5.9.8, 5.9.9, 5.9.10, 5.9.11, 5.9.12, 5.9.13, and 5.9.14, TIBCO EBX: versions 6.0.0 and 6.0.1, and TIBCO Product and Service Catalog powered by TIBCO EBX: version 1.0.0. |
| CVE-2021-41296 | Critical | 2021-09-30 | Not applicable | No public exploit | ECOA BAS controller uses weak set of default administrative credentials that can be easily guessed in remote password attacks and gain full control of the system. |
| CVE-2021-28914 | Medium | 2021-09-09 | Not applicable | No public exploit | BAB TECHNOLOGIE GmbH eibPort V3 prior version 3.9.1 allow the user to set a weak password because the strength is shown in configuration tool, but finally not enforced. This is usable and part of an attack chain to gain SSH root access. |
| CVE-2021-28912 | High | 2021-09-09 | Not applicable | No public exploit | BAB TECHNOLOGIE GmbH eibPort V3. Each device has its own unique hard coded and weak root SSH key passphrase known as 'eibPort string'. This is usable and the final part of an attack chain to gain SSH root access. |
| CVE-2021-20418 | Critical | 2021-08-11 | Not applicable | No public exploit | IBM Security Guardium 11.2 does not require that users should have strong passwords by default, which makes it easier for attackers to compromise user accounts. IBM X-Force ID: 196279. |
| CVE-2021-1522 | Medium | 2021-08-04 | Outside Waratek scope | No public exploit | A vulnerability in the change password API of Cisco Connected Mobile Experiences (CMX) could allow an authenticated, remote attacker to alter their own password to a value that does not comply with the strong authentication requirements that are configured on an affected device. This vulnerability exists because a password policy check is incomplete at the time a password is changed at server side using the API. An attacker could exploit this vulnerability by sending a specially crafted API request to the affected device. A successful exploit could allow the attacker to change their own password to a value that does not comply with the configured strong authentication requirements. |
| CVE-2021-32753 | High | 2021-07-09 | Not applicable | No public exploit | EdgeX Foundry is an open source project for building a common open framework for internet-of-things edge computing. A vulnerability exists in the Edinburgh, Fuji, Geneva, and Hanoi versions of the software. When the EdgeX API gateway is configured for OAuth2 authentication and a proxy user is created, the client_id and client_secret required to obtain an OAuth2 authentication token are set to the username of the proxy user. A remote network attacker can then perform a dictionary-based password attack on the OAuth2 token endpoint of the API gateway to obtain an OAuth2 authentication token and use that token to make authenticated calls to EdgeX microservices from an untrusted network. OAuth2 is the default authentication method in EdgeX Edinburgh release. The default authentication method was changed to JWT in Fuji and later releases. Users should upgrade to the EdgeX Ireland release to obtain the fix. The OAuth2 authentication method is disabled in Ireland release. If unable to upgrade and OAuth2 authentication is required, users should create OAuth2 users directly using the Kong admin API and forgo the use of the `security-proxy-setup` tool to create OAuth2 users. |
| CVE-2021-25923 | High | 2021-06-24 | Not applicable | No public exploit | In OpenEMR, versions 5.0.0 to 6.0.0.1 are vulnerable to weak password requirements as it does not enforce a maximum password length limit. If a malicious user is aware of the first 72 characters of the victim user’s password, he can leverage it to an account takeover. |
| CVE-2021-26797 | Critical | 2021-04-26 | Not applicable | No public exploit | An access control vulnerability in Hame SD1 Wi-Fi firmware <=V.20140224154640 allows an attacker to get system administrator through an open Telnet service. |
| CVE-2021-25839 | Critical | 2021-04-26 | Not applicable | No public exploit | A weak password requirement vulnerability exists in the Create New User function of MintHCM RELEASE 3.0.8, which could lead an attacker to easier password brute-forcing. |
| CVE-2020-11925 | High | 2021-04-02 | Not applicable | No public exploit | An issue was discovered in Luvion Grand Elite 3 Connect through 2020-02-25. Authentication to the device is based on a username and password. The root credentials are the same across all devices of this model. |
| CVE-2020-8296 | Medium | 2021-03-03 | Not applicable | No public exploit | Nextcloud Server prior to 20.0.0 stores passwords in a recoverable format even when external storage is not configured. |
| CVE-2021-25309 | Critical | 2021-03-02 | Not applicable | No public exploit | The telnet administrator service running on port 650 on Gigaset DX600A v41.00-175 devices does not implement any lockout or throttling functionality. This situation (together with the weak password policy that forces a 4-digit password) allows remote attackers to easily obtain administrative access via brute-force attacks. |
| CVE-2020-25153 | Critical | 2020-12-23 | Not applicable | No public exploit | The built-in web service for MOXA NPort IAW5000A-I/O firmware version 2.1 or lower does not require users to have strong passwords. |
| CVE-2020-29591 | Critical | 2020-12-11 | Not applicable | No public exploit | Versions of the Official registry Docker images through 2.7.0 contain a blank password for the root user. Systems deployed using affected versions of the registry container may allow a remote attacker to achieve root access with a blank password. |
| CVE-2020-26201 | Critical | 2020-12-10 | Not applicable | No public exploit | Askey AP5100W_Dual_SIG_1.01.097 and all prior versions use a weak password at the Operating System (rlx-linux) level. This allows an attacker to gain unauthorized access as an admin or root user to the device Operating System via Telnet or SSH. |
| CVE-2020-27587 | Medium | 2020-11-30 | Not applicable | No public exploit | Quick Heal Total Security before 19.0 allows attackers with local admin rights to obtain access to files in the File Vault via a brute-force attack on the password. |
| CVE-2020-27585 | Medium | 2020-11-30 | Not applicable | No public exploit | Quick Heal Total Security before 19.0 allows attackers with local admin rights to modify sensitive anti virus settings via a brute-attack on the settings password. |
| CVE-2020-8956 | Low | 2020-10-27 | Not applicable | No public exploit | Pulse Secure Desktop Client 9.0Rx before 9.0R5 and 9.1Rx before 9.1R4 on Windows reveals users' passwords if Save Settings is enabled. |
| CVE-2019-17444 | Critical | 2020-10-12 | Not applicable | Working exploit published | Jfrog Artifactory uses default passwords (such as "password") for administrative accounts and does not require users to change them. This may allow unauthorized network-based attackers to completely compromise of Jfrog Artifactory. This issue affects Jfrog Artifactory versions prior to 6.17.0. |
| CVE-2020-26103 | High | 2020-09-25 | Not applicable | No public exploit | In cPanel before 88.0.3, an insecure site password is used for Mailman on a templated VM (SEC-551). |
| CVE-2020-15369 | High | 2020-09-25 | Not applicable | No public exploit | Supportlink CLI in Brocade Fabric OS Versions v8.2.1 through v8.2.1d, and 8.2.2 versions before v8.2.2c does not obfuscate the password field, which could expose users’ credentials of the remote server. An authenticated user could obtain the exposed password credentials to gain access to the remote host. |
| CVE-2019-4698 | High | 2020-08-26 | Not applicable | No public exploit | IBM Security Guardium Data Encryption (GDE) 3.0.0.2 does not require that users should have strong passwords by default, which makes it easier for attackers to compromise user accounts. IBM X-Force ID: 171929. |
| CVE-2015-8033 | Medium | 2020-08-14 | Not applicable | No public exploit | In Textpattern 4.5.7, the password-reset feature does not securely tether a hash to a user account. |
| CVE-2020-15115 | High | 2020-08-06 | Not applicable | No public exploit | etcd before versions 3.3.23 and 3.4.10 does not perform any password length validation, which allows for very short passwords, such as those with a length of one. This may allow an attacker to guess or brute-force users' passwords with little computational effort. |
| CVE-2020-4574 | High | 2020-07-29 | Not applicable | No public exploit | IBM Tivoli Key Lifecycle Manager does not require that users should have strong passwords by default, which makes it easier for attackers to compromise user accounts. IBM X-Force ID: 184181. |
| CVE-2020-7519 | High | 2020-07-23 | Not applicable | No public exploit | A CWE-521: Weak Password Requirements vulnerability exists in Easergy Builder (Version 1.4.7.2 and older) which could allow an attacker to compromise a user account. |