Overview 97 matches · 1 in Waratek scope · 0 protected · 2 exploited · 1 CISA KEV · 1 public PoC · 0 EPSS ≥ 0.5
97matches
1in Waratek scope1.0%
0protected0.0%
2exploited2.1%
1CISA KEV1.0%
1public PoC1.0%
0EPSS ≥ 0.50.0%
Protected by Waratek
0
0.0%
Rule in development
0
0.0%
Mitigation candidate
0
0.0%
No exploit published
1
1.0%
Outside Waratek scope
1
1.0%
Not applicable
95
97.9%
Withdrawn CVE
0
0.0%
blocked by ARMR today
0
0.0%
partly blocked
0
0.0%
not blocked
97
100.0%
not established
0
0.0%
unrecorded
0
0.0%
split by
peak 16 / year
20121
Not applicable1
High1
not blocked1
Working exploit published1
20130
20140
20150
20160
20170
20189
Not applicable9
High9
not blocked9
No public exploit9
20198
Not applicable8
High8
not blocked8
No public exploit8
202012
Not applicable12
High12
not blocked12
Exploited1
No public exploit11
20216
Outside Waratek scope1
Not applicable5
High6
not blocked6
No public exploit6
202213
Not applicable13
High13
not blocked13
Proof of concept only1
No public exploit12
202316
Not applicable16
High16
not blocked16
Proof of concept only4
No public exploit12
202413
Not applicable13
High13
not blocked13
Proof of concept only4
No public exploit9
202513
No exploit published1
Not applicable12
High13
not blocked13
Exploited1
Proof of concept only4
No public exploit8
20266
Not applicable6
High6
not blocked6
No public exploit6
20122014201620182020202220242026
| CVE | Severity | Published▾ | Status | Exploitation | Description |
|---|---|---|---|---|---|
| CVE-2026-116417 | High | 2026-11-13 | Not applicable | No public exploit | Dell PowerScale InsightIQ, versions 6.3.0 through 6.4.0, contains a Weak Password Requirements vulnerability. An unauthenticated attacker with adjacent network access could potentially exploit this vulnerability, leading to Information disclosure and Unauthorized access. |
| CVE-2026-41021 | High | 2026-10-27 | Not applicable | No public exploit | Eaton easyE4 uses an insufficiently strong password policy. An attacker who obtains a password hash, including through CVE-2026-41020, could perform an offline password-guessing attack and potentially recover user credentials. |
| CVE-2026-19293 | High | 2026-08-13 | Not applicable | No public exploit | SMP security request (from peripheral) does not include the maximum encryption key size supported. Using a key with less than the maximum keysize makes brute-forcing the key easier. See V6 in BLERP paper linked below. |
| CVE-2026-12504 | High | 2026-07-24 | Not applicable | No public exploit | Improper Authentication (CWE-287) in the PAM configuration in Loytec LIP-ME201C, L-INX, L-GATE, L-ROC, L-IOB, L-DALI, L-VIS and L-PAD through 8.4.16 on LINX-A64 allows a local attacker to authenticate as a uid=0 account without a password and obtain a root shell via an `/etc/passwd` entry with an empty password field. |
| CVE-2026-41038 | High | 2026-04-21 | Not applicable | No public exploit | This vulnerability exists in Quantum Networks router due to lack of enforcement of strong password policies in the web-based management interface. An attacker on the same network could exploit this vulnerability by performing password guessing or brute-force attacks against user accounts, leading to unauthorized access to the targeted device. |
| CVE-2025-68716 | High | 2026-01-08 | Not applicable | No public exploit | KAYSUS KS-WR3600 routers with firmware 1.0.5.9.1 enable the SSH service enabled by default on the LAN interface. The root account is configured with no password, and administrators cannot disable SSH or enforce authentication via the CLI or web GUI. This allows any LAN-adjacent attacker to trivially gain root shell access and execute arbitrary commands with full privileges. |
| CVE-2025-23408 | High | 2025-12-12 | Not applicable | No public exploit | Weak Password Requirements vulnerability in Apache Fineract. This issue affects Apache Fineract: through 1.10.1. The issue is fixed in version 1.11.0. Users are encouraged to upgrade to version 1.13.0, the latest release. |
| CVE-2025-63800 | High | 2025-11-18 | Not applicable | No public exploit | The password change endpoint in Open Source Point of Sale 3.4.1 allows users to set their account password to an empty string due to missing server-side validation. When an authenticated user omits or leaves the `password` and `repeat_password` parameters empty in the password change request, the backend still returns a successful response and sets the password to an empty string. This effectively disables authentication and may allow unauthorized access to user or administrative accounts. |
| CVE-2025-55034 | High | 2025-11-15 | Not applicable | No public exploit | General Industrial Controls Lynx+ Gateway is vulnerable to a weak password requirement vulnerability, which may allow an attacker to execute a brute-force attack resulting in unauthorized access and login. |
| CVE-2025-60954 | High | 2025-10-24 | Not applicable | Proof of concept only | Microweber CMS 2.0 has Weak Password Requirements. The application does not enforce minimum password length or complexity during password resets. Users can set extremely weak passwords, including single-character passwords, which can lead to account compromise, including administrative accounts. |
| CVE-2023-49883 | High | 2025-10-01 | Not applicable | No public exploit | IBM Transformation Extender Advanced 10.0.1 does not require that users should have strong passwords by default, which makes it easier for attackers to compromise user accounts. |
| CVE-2025-9964 | High | 2025-09-23 | Not applicable | No public exploit | No password for the root user is set in Novakon P series. This allows phyiscal attackers to enter the console easily. This issue affects P series: P – V2001.A.C518o2 until P-2.0.05 Build 2026.02.06 (commit d0f97fd9). |
| CVE-2025-57295 | High | 2025-09-18 | Not applicable | Proof of concept only | H3C devices running firmware version NX15V100R015 are vulnerable to unauthorized access due to insecure default credentials. The root user account has no password set, and the H3C user account uses the default password "admin," both stored in the /etc/shadow file. Attackers with network access can exploit these credentials to gain unauthorized root-level access to the device via the administrative interface or other network services, potentially leading to privilege escalation, information disclosure, or arbitrary code execution. |
| CVE-2025-34058 | High | 2025-07-01 | Not applicable | Exploited | Hikvision Streaming Media Management Server v2.3.5 uses default credentials that allow remote attackers to authenticate and access restricted functionality. After authenticating with these credentials, an attacker can exploit an arbitrary file read vulnerability in the /systemLog/downFile.php endpoint via directory traversal in the fileName parameter. This exploit chain can enable unauthorized access to sensitive system files. |
| CVE-2025-52997 | High | 2025-06-30 | Not applicable | Proof of concept only | File Browser provides a file managing interface within a specified directory and it can be used to upload, delete, preview, rename and edit files. Prior to version 2.34.1, a missing password policy and brute-force protection makes the authentication process insecure. Attackers could mount a brute-force attack to retrieve the passwords of all accounts in a given instance. This issue has been patched in version 2.34.1. |
| CVE-2023-27272 | High | 2025-04-14 | Not applicable | No public exploit | IBM Aspera Console 3.4.0 through 3.4.4 allows passwords to be reused when a new user logs into the system. |
| CVE-2025-22228 | High | 2025-03-20 | No exploit published | No public exploit | BCryptPasswordEncoder.matches(CharSequence,String) will incorrectly return true for passwords larger than 72 characters as long as the first 72 characters are the same. |
| CVE-2025-25749 | High | 2025-03-11 | Not applicable | Proof of concept only | An issue in HotelDruid version 3.0.7 and earlier allows users to set weak passwords due to the lack of enforcement of password strength policies. |
| CVE-2025-22390 | High | 2025-01-04 | Not applicable | No public exploit | An issue was discovered in Optimizely EPiServer.CMS.Core before 12.32.0. A medium-severity vulnerability exists in the CMS due to insufficient enforcement of password complexity requirements. The application permits users to set passwords with a minimum length of 6 characters, lacking adequate complexity to resist modern attack techniques such as password spraying or offline password cracking. |
| CVE-2024-48271 | High | 2024-10-30 | Not applicable | Proof of concept only | D-Link DSL6740C v6.TR069.20211230 was discovered to use insecure default credentials for Administrator access, possibly allowing attackers to bypass authentication and escalate privileges on the device via a bruteforce attack. |
| CVE-2024-7293 | High | 2024-10-09 | Not applicable | No public exploit | In Progress® Telerik® Report Server versions prior to 2024 Q3 (10.2.24.806), a password brute forcing attack is possible through weak password requirements. |
| CVE-2024-47221 | High | 2024-09-22 | Not applicable | No public exploit | CheckUser in ScadaServerEngine/MainLogic.cs in Rapid SCADA through 5.8.4 allows an empty password. |
| CVE-2021-38133 | High | 2024-09-12 | Not applicable | No public exploit | Possible External Service Interaction attack in eDirectory has been discovered in OpenText™ eDirectory. This impact all version before 9.2.6.0000. |
| CVE-2022-39997 | High | 2024-08-27 | Not applicable | Proof of concept only | A weak password requirement issue was discovered in Teldats Router RS123, RS123w allows a remote attacker to escalate privileges |
| CVE-2024-40697 | High | 2024-08-13 | Not applicable | No public exploit | IBM Common Licensing 9.0 does not require that users should have strong passwords by default, which makes it easier for attackers to compromise user accounts. IBM X-Force ID: 297895. |
| CVE-2023-41923 | High | 2024-07-02 | Not applicable | No public exploit | The user management section of the web application permits the creation of user accounts with excessively weak passwords, including single-character passwords. |
| CVE-2024-36789 | High | 2024-06-07 | Not applicable | Proof of concept only | An issue in Netgear WNR614 JNR1010V2/N300-V1.1.0.54_1.0.1 allows attackers to create passwords that do not conform to defined security standards. |
| CVE-2024-25729 | High | 2024-03-08 | Not applicable | No public exploit | Arris SBG6580 devices have predictable default WPA2 security passwords that could lead to unauthorized remote access. (They use the first 6 characters of the SSID and the last 6 characters of the BSSID, decrementing the last octet.) |
| CVE-2023-38369 | High | 2024-02-07 | Not applicable | No public exploit | IBM Security Access Manager Container 10.0.0.0 through 10.0.6.1 does not require that docker images should have strong passwords by default, which makes it easier for attackers to compromise user accounts. IBM X-Force ID: 261196. |
| CVE-2023-43016 | High | 2024-02-03 | Not applicable | Proof of concept only | IBM Security Access Manager Container (IBM Security Verify Access Appliance 10.0.0.0 through 10.0.6.1 and IBM Security Verify Access Docker 10.0.0.0 through 10.0.6.1) could allow a remote user to log into the server due to a user account with an empty password. IBM X-Force ID: 266154. |
| CVE-2024-0676 | High | 2024-01-30 | Not applicable | No public exploit | Weak password requirement vulnerability in Lamassu Bitcoin ATM Douro machines, in its 7.1 version , which allows a local user to interact with the machine where the application is installed, retrieve stored hashes from the machine and crack long 4-character passwords using a dictionary attack. |
| CVE-2024-0188 | High | 2024-01-02 | Not applicable | No public exploit | A vulnerability, which was classified as problematic, was found in RRJ Nueva Ecija Engineer Online Portal 1.0. This affects an unknown part of the file change_password_teacher.php. The manipulation leads to weak password requirements. It is possible to initiate the attack remotely. The complexity of an attack is rather high. The exploitability is told to be difficult. The exploit has been disclosed to the public and may be used. The identifier VDB-249501 was assigned to this vulnerability. |
| CVE-2023-7053 | High | 2023-12-22 | Not applicable | No public exploit | A vulnerability was found in PHPGurukul Online Notes Sharing System 1.0. It has been declared as problematic. This vulnerability affects unknown code of the file /user/signup.php. The manipulation leads to weak password requirements. The attack can be initiated remotely. The complexity of an attack is rather high. The exploitation appears to be difficult. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-248740. |
| CVE-2023-41353 | High | 2023-11-03 | Not applicable | No public exploit | Chunghwa Telecom NOKIA G-040W-Q has a vulnerability of weak password requirements. A remote attacker with regular user privilege can easily infer the administrator password from system information after logging system, resulting in admin access and performing arbitrary system operations or disrupt service. |
| CVE-2023-40707 | High | 2023-08-24 | Not applicable | No public exploit | There are no requirements for setting a complex password in the built-in web server of the SNAP PAC S1 Firmware version R10.3b, which could allow for a successful brute force attack if users don't set up complex credentials. |
| CVE-2023-4125 | High | 2023-08-03 | Not applicable | Proof of concept only | Weak Password Requirements in GitHub repository answerdev/answer prior to v1.1.0. |
| CVE-2023-3089 | High | 2023-07-05 | Not applicable | No public exploit | A compliance problem was found in the Red Hat OpenShift Container Platform. Red Hat discovered that, when FIPS mode was enabled, not all of the cryptographic modules in use were FIPS-validated. |
| CVE-2023-3423 | High | 2023-06-27 | Not applicable | No public exploit | Weak Password Requirements in GitHub repository cloudexplorer-dev/cloudexplorer-lite prior to v 1.2.0. |
| CVE-2023-2060 | High | 2023-06-02 | Not applicable | No public exploit | Weak Password Requirements vulnerability in FTP function on Mitsubishi Electric Corporation MELSEC iQ-R Series EtherNet/IP module RJ71EIP91 and MELSEC iQ-F Series EtherNet/IP module FX5-ENET/IP allows a remote unauthenticated attacker to access to the module via FTP by dictionary attack or password sniffing. |
| CVE-2023-25184 | High | 2023-05-10 | Not applicable | No public exploit | Use of weak credentials exists in Seiko Solutions SkyBridge and SkySpider series, which may allow a remote unauthenticated attacker to decrypt password for the WebUI of the product. Affected products and versions are as follows: SkyBridge MB-A200 firmware Ver. 01.00.05 and earlier, SkyBridge BASIC MB-A130 firmware Ver. 1.4.1 and earlier, and SkySpider MB-R210 firmware Ver. 1.01.00 and earlier. |
| CVE-2023-25072 | High | 2023-05-10 | Not applicable | No public exploit | Use of weak credentials exists in SkyBridge MB-A100/110 firmware Ver. 4.2.0 and earlier, which may allow a remote unauthenticated attacker to decrypt password for the WebUI of the product. |
| CVE-2023-31043 | High | 2023-04-23 | Not applicable | No public exploit | EnterpriseDB EDB Postgres Advanced Server (EPAS) before 14.6.0 logs unredacted passwords in situations where optional parameters are used with CREATE/ALTER USER/GROUP/ROLE, and redacting was configured with edb_filter_log.redact_password_commands. The fixed versions are 10.23.33, 11.18.29, 12.13.17, 13.9.13, and 14.6.0. |
| CVE-2023-24502 | High | 2023-04-17 | Not applicable | No public exploit | Electra Central AC unit – The unit opens an AP with an easily calculated password. |
| CVE-2022-34333 | High | 2023-04-07 | Not applicable | No public exploit | IBM Sterling Order Management 10.0 does not require that users should have strong passwords by default, which makes it easier for attackers to compromise user accounts. IBM X-Force ID: 229698. |
| CVE-2022-45635 | High | 2023-03-21 | Not applicable | Proof of concept only | An issue discovered in MEGAFEIS, BOFEI DBD+ Application for IOS & Android v1.4.4 allows attacker to gain access to sensitive account information via insecure password policy. |
| CVE-2023-0793 | High | 2023-02-12 | Not applicable | Proof of concept only | Weak Password Requirements in GitHub repository thorsten/phpmyfaq prior to 3.1.11. |
| CVE-2023-0564 | High | 2023-01-29 | Not applicable | Proof of concept only | Weak Password Requirements in GitHub repository froxlor/froxlor prior to 2.0.10. |
| CVE-2023-22451 | High | 2023-01-02 | Not applicable | No public exploit | Kiwi TCMS is an open source test management system. In version 11.6 and prior, when users register new accounts and/or change passwords, there is no validation in place which would prevent them from picking an easy to guess password. This issue is resolved by providing defaults for the `AUTH_PASSWORD_VALIDATORS` configuration setting. As of version 11.7, the password can’t be too similar to other personal information, must contain at least 10 characters, can’t be a commonly used password, and can’t be entirely numeric. As a workaround, an administrator may reset all passwords in Kiwi TCMS if they think a weak password may have been chosen. |
| CVE-2021-39434 | High | 2022-12-06 | Not applicable | No public exploit | A default username and password for an administrator account was discovered in ZKTeco ZKTime 10.0 through 11.1.0, builds 20180901, 20190510.1, 20200309.3, 20200930, 20201231, and 20210220. |
| CVE-2022-43030 | High | 2022-11-14 | Not applicable | Proof of concept only | Siyucms v6.1.7 was discovered to contain a remote code execution (RCE) vulnerability in the background. SIYUCMS is a content management system based on ThinkPaP5 AdminLTE. SIYUCMS has a background command execution vulnerability, which can be used by attackers to gain server privileges |
| CVE-2022-3179 | High | 2022-09-13 | Not applicable | No public exploit | Weak Password Requirements in GitHub repository ikus060/rdiffweb prior to 2.4.2. |
| CVE-2022-27558 | High | 2022-08-29 | Not applicable | No public exploit | HCL iNotes is susceptible to a Broken Password Strength Checks vulnerability. Custom password policies are not enforced on certain iNotes forms which could allow users to set weak passwords, leading to easier cracking. |
| CVE-2022-34772 | High | 2022-08-22 | Not applicable | No public exploit | Tabit - password enumeration. Description: Tabit - password enumeration. The passwords for the Tabit system is a 4 digit OTP. One can resend OTP and try logging in indefinitely. Once again, this is an example of OWASP: API4 - Rate limiting. |
| CVE-2022-26117 | High | 2022-07-18 | Not applicable | No public exploit | An empty password in configuration file vulnerability [CWE-258] in FortiNAC version 8.3.7 and below, 8.5.2 and below, 8.5.4, 8.6.0, 8.6.5 and below, 8.7.6 and below, 8.8.11 and below, 9.1.5 and below, 9.2.3 and below may allow an authenticated attacker to access the MySQL databases via the CLI. |
| CVE-2022-28377 | High | 2022-07-14 | Not applicable | No public exploit | On Verizon 5G Home LVSKIHP InDoorUnit (IDU) 3.4.66.162 and OutDoorUnit (ODU) 3.33.101.0 devices, the CRTC and ODU RPC endpoints rely on a static account username/password for access control. This password can be generated via a binary included in the firmware, after ascertaining the MAC address of the IDU's base Ethernet interface, and adding the string DEVICE_MANUFACTURER='Wistron_NeWeb_Corp.' to /etc/device_info to replicate the host environment. This occurs in /etc/init.d/wnc_factoryssidkeypwd (IDU). |
| CVE-2022-30325 | High | 2022-06-16 | Not applicable | No public exploit | An issue was found on TRENDnet TEW-831DR 1.0 601.130.1.1356 devices. The default pre-shared key for the Wi-Fi networks is the same for every router except for the last four digits. The device default pre-shared key for both 2.4 GHz and 5 GHz networks can be guessed or brute-forced by an attacker within range of the Wi-Fi network. |
| CVE-2022-29729 | High | 2022-06-02 | Not applicable | No public exploit | Verizon 4G LTE Network Extender GA4.38 - V0.4.038.2131 utilizes a weak default admin password generation algorithm which generates passwords that are accessible to unauthenticated attackers via the webUI login page. |
| CVE-2022-29098 | High | 2022-06-01 | Not applicable | No public exploit | Dell PowerScale OneFS versions 8.2.0.x through 9.3.0.x, contain a weak password requirement vulnerability. An administrator may create an account with no password. A remote attacker may potentially exploit this leading to a user account compromise. |
| CVE-2022-29700 | High | 2022-04-27 | Not applicable | No public exploit | A lack of password length restriction in Zammad v5.1.0 allows for the creation of extremely long passwords which can cause a Denial of Service (DoS) during password verification. |
| CVE-2021-38935 | High | 2022-02-18 | Not applicable | No public exploit | IBM Maximo Asset Management 7.6.1.2 does not require that users should have strong passwords by default, which makes it easier for attackers to compromise user accounts. IBM X-Force ID: 210892. |
| CVE-2022-22110 | High | 2022-01-05 | Not applicable | No public exploit | In Daybyday CRM, versions 1.1 through 2.2.0 enforce weak password requirements in the user update functionality. A user with privileges to update his password could change it to a weak password, such as those with a length of a single character. This may allow an attacker to brute-force users’ passwords with minimal to no computational effort. |
| CVE-2021-43471 | High | 2021-12-06 | Not applicable | No public exploit | In Canon LBP223 printers, the System Manager Mode login does not require an account password or PIN. An attacker can remotely shut down the device after entering the background, creating a denial of service vulnerability. |
| CVE-2021-20470 | High | 2021-12-03 | Outside Waratek scope | No public exploit | IBM Cognos Analytics 11.1.7 and 11.2.0 does not require that users should have strong passwords by default, which makes it easier for attackers to compromise user accounts. IBM X-Force ID: 196339. |
| CVE-2021-28912 | High | 2021-09-09 | Not applicable | No public exploit | BAB TECHNOLOGIE GmbH eibPort V3. Each device has its own unique hard coded and weak root SSH key passphrase known as 'eibPort string'. This is usable and the final part of an attack chain to gain SSH root access. |
| CVE-2021-32753 | High | 2021-07-09 | Not applicable | No public exploit | EdgeX Foundry is an open source project for building a common open framework for internet-of-things edge computing. A vulnerability exists in the Edinburgh, Fuji, Geneva, and Hanoi versions of the software. When the EdgeX API gateway is configured for OAuth2 authentication and a proxy user is created, the client_id and client_secret required to obtain an OAuth2 authentication token are set to the username of the proxy user. A remote network attacker can then perform a dictionary-based password attack on the OAuth2 token endpoint of the API gateway to obtain an OAuth2 authentication token and use that token to make authenticated calls to EdgeX microservices from an untrusted network. OAuth2 is the default authentication method in EdgeX Edinburgh release. The default authentication method was changed to JWT in Fuji and later releases. Users should upgrade to the EdgeX Ireland release to obtain the fix. The OAuth2 authentication method is disabled in Ireland release. If unable to upgrade and OAuth2 authentication is required, users should create OAuth2 users directly using the Kong admin API and forgo the use of the `security-proxy-setup` tool to create OAuth2 users. |
| CVE-2021-25923 | High | 2021-06-24 | Not applicable | No public exploit | In OpenEMR, versions 5.0.0 to 6.0.0.1 are vulnerable to weak password requirements as it does not enforce a maximum password length limit. If a malicious user is aware of the first 72 characters of the victim user’s password, he can leverage it to an account takeover. |
| CVE-2020-11925 | High | 2021-04-02 | Not applicable | No public exploit | An issue was discovered in Luvion Grand Elite 3 Connect through 2020-02-25. Authentication to the device is based on a username and password. The root credentials are the same across all devices of this model. |
| CVE-2020-26103 | High | 2020-09-25 | Not applicable | No public exploit | In cPanel before 88.0.3, an insecure site password is used for Mailman on a templated VM (SEC-551). |
| CVE-2020-15369 | High | 2020-09-25 | Not applicable | No public exploit | Supportlink CLI in Brocade Fabric OS Versions v8.2.1 through v8.2.1d, and 8.2.2 versions before v8.2.2c does not obfuscate the password field, which could expose users’ credentials of the remote server. An authenticated user could obtain the exposed password credentials to gain access to the remote host. |
| CVE-2019-4698 | High | 2020-08-26 | Not applicable | No public exploit | IBM Security Guardium Data Encryption (GDE) 3.0.0.2 does not require that users should have strong passwords by default, which makes it easier for attackers to compromise user accounts. IBM X-Force ID: 171929. |
| CVE-2020-15115 | High | 2020-08-06 | Not applicable | No public exploit | etcd before versions 3.3.23 and 3.4.10 does not perform any password length validation, which allows for very short passwords, such as those with a length of one. This may allow an attacker to guess or brute-force users' passwords with little computational effort. |
| CVE-2020-4574 | High | 2020-07-29 | Not applicable | No public exploit | IBM Tivoli Key Lifecycle Manager does not require that users should have strong passwords by default, which makes it easier for attackers to compromise user accounts. IBM X-Force ID: 184181. |
| CVE-2020-7519 | High | 2020-07-23 | Not applicable | No public exploit | A CWE-521: Weak Password Requirements vulnerability exists in Easergy Builder (Version 1.4.7.2 and older) which could allow an attacker to compromise a user account. |
| CVE-2016-11069 | High | 2020-06-19 | Not applicable | No public exploit | An issue was discovered in Mattermost Server before 3.2.0. It mishandles brute-force attempts at password change. |
| CVE-2020-4245 | High | 2020-05-28 | Not applicable | No public exploit | IBM Security Identity Governance and Intelligence 5.2.6 does not require that users should have strong passwords by default, which makes it easier for attackers to compromise user accounts. IBM X-Force ID: 175423. |
| CVE-2019-18872 | High | 2020-05-07 | Not applicable | No public exploit | Weak password requirements in Blaauw Remote Kiln Control through v3.00r4 allow a user to set short or guessable passwords (e.g., 1 or 1234). |
| CVE-2019-6558 | High | 2020-03-23 | Not applicable | No public exploit | In Auto-Maskin RP210E Versions 3.7 and prior, DCU210E Versions 3.7 and prior and Marine Observer Pro (Android App), the software contains a mechanism for users to recover or change their passwords without knowing the original password, but the mechanism is weak. |
| CVE-2019-18988 | High | 2020-02-07 | Not applicable | Exploited | TeamViewer Desktop through 14.7.1965 allows a bypass of remote-login access control because the same key is used for different customers' installations. It used a shared AES key for all installations since at least as far back as v7.0.43148, and used it for at least OptionsPasswordAES in the current version of the product. If an attacker were to know this key, they could decrypt protect information stored in the registry or configuration files of TeamViewer. With versions before v9.x , this allowed for attackers to decrypt the Unattended Access password to the system (which allows for remote login to the system as well as headless file browsing). The latest version still uses the same key for OptionPasswordAES but appears to have changed how the Unattended Access password is stored. While in most cases an attacker requires an existing session on a system, if the registry/configuration keys were stored off of the machine (such as in a file share or online), an attacker could then decrypt the required password to login to the system. |
| CVE-2020-7940 | High | 2020-01-23 | Not applicable | No public exploit | Missing password strength checks on some forms in Plone 4.3 through 5.2.0 allow users to set weak passwords, leading to easier cracking. |
| CVE-2011-4931 | High | 2019-10-29 | Not applicable | No public exploit | gpw generates shorter passwords than required |
| CVE-2019-4565 | High | 2019-09-20 | Not applicable | No public exploit | IBM Security Key Lifecycle Manager 3.0 and 3.0.1 does not require that users should have strong passwords by default, which makes it easier for attackers to compromise user accounts. IBM X-Force ID: 166626. |
| CVE-2019-4321 | High | 2019-09-05 | Not applicable | No public exploit | IBM Intelligent Operations Center V5.1.0 - V5.2.0, IBM Intelligent Operations Center for Emergency Management V5.1.0 - V5.1.0.6, and IBM Water Operations for Waternamics V5.1.0 - V5.2.1.1 does not require that users should have strong passwords by default, which makes it easier for attackers to compromise user accounts. IBM X-Force ID: 161201. |
| CVE-2019-4235 | High | 2019-06-26 | Not applicable | No public exploit | IBM PureApplication System 2.2.3.0 through 2.2.5.3 does not require that users should have strong passwords by default, which makes it easier for attackers to compromise user accounts. IBM X-Force ID: 159417. |
| CVE-2019-4067 | High | 2019-06-07 | Not applicable | No public exploit | IBM Intelligent Operations Center (IOC) 5.1.0 through 5.2.0 does not require that users should have strong passwords by default, which makes it easier for attackers to compromise user accounts. IBM X-Force ID: 157012. |
| CVE-2018-1680 | High | 2019-04-02 | Not applicable | No public exploit | IBM Security Privileged Identity Manager Virtual Appliance 2.2.1 does not require that users should have strong passwords by default, which makes it easier for attackers to compromise user accounts. IBM X-Force ID: 145236. |
| CVE-2019-7676 | High | 2019-02-09 | Not applicable | No public exploit | A weak password vulnerability was discovered in Enphase Envoy R3.*.*. One can login via TCP port 8888 with the admin password for the admin account. |
| CVE-2018-1956 | High | 2019-01-14 | Not applicable | No public exploit | IBM Security Identity Manager 6.0.0 does not require that users should have strong passwords by default, which makes it easier for attackers to compromise user accounts. IBM X-Force ID: 153628. |
| CVE-2017-1597 | High | 2018-12-17 | Not applicable | No public exploit | IBM Security Guardium 10.0, 10.0.1, 10.1, 10.1.2, 10.1.3, 10.1.4, and 10.5 Database Activity Monitor does not require that users should have strong passwords by default, which makes it easier for attackers to compromise user accounts. IBM X-Force ID: 132610. |
| CVE-2018-18562 | High | 2018-11-20 | Not applicable | No public exploit | An issue was discovered in Roche Accu-Chek Inform II Base Unit / Base Unit Hub before 03.01.04 and CoaguChek / cobas h232 Handheld Base Unit before 03.01.04. Weak access credentials may enable attackers in the adjacent network to gain unauthorized service access via a service interface. |
| CVE-2018-17906 | High | 2018-11-19 | Not applicable | No public exploit | Philips iSite and IntelliSpace PACS, iSite PACS, all versions, and IntelliSpace PACS, all versions. Default credentials and no authentication within third party software may allow an attacker to compromise a component of the system. |
| CVE-2018-15766 | High | 2018-10-11 | Not applicable | No public exploit | On install, Dell Encryption versions prior 10.0.1 and Dell Endpoint Security Suite Enterprise versions prior 2.0.1 will overwrite and manually set the "Minimum Password Length" group policy object to a value of 1 on that device. This allows for users to bypass any existing policy for password length and potentially create insecure password on their device. This value is defined during the installation of the "Encryption Management Agent" or "EMAgent" application. There are no other known values modified. |
| CVE-2017-9818 | High | 2018-08-24 | Not applicable | No public exploit | The National Payments Corporation of India BHIM application 1.3 for Android relies on a four-digit passcode, which makes it easier for attackers to obtain access. |
| CVE-2018-15748 | High | 2018-08-23 | Not applicable | No public exploit | On Dell 2335dn printers with Printer Firmware Version 2.70.05.02, Engine Firmware Version 1.10.65, and Network Firmware Version V4.02.15(2335dn MFP) 11-22-2010, the admin interface allows an authenticated attacker to retrieve the configured SMTP or LDAP password by viewing the HTML source code of the Email Settings webpage. In some cases, authentication can be achieved with the blank default password for the admin account. NOTE: the vendor indicates that this is an "End Of Support Life" product. |
| CVE-2018-1101 | High | 2018-05-02 | Not applicable | No public exploit | Ansible Tower before version 3.2.4 has a flaw in the management of system and organization administrators that allows for privilege escalation. System administrators that are members of organizations can have their passwords reset by organization administrators, allowing organization administrators access to the entire system. |
| CVE-2018-6312 | High | 2018-03-10 | Not applicable | No public exploit | A privileged account with a weak default password on the Foxconn femtocell FEMTO AP-FC4064-T version AP_GT_B38_5.8.3lb15-W47 LTE Build 15 can be used to turn on the TELNET service via the web interface, which allows root login without any password. This vulnerability will lead to full system compromise and disclosure of user communications. The foxconn account with an 8-character lowercase alphabetic password can be used. |
| CVE-2018-0204 | High | 2018-02-22 | Not applicable | No public exploit | A vulnerability in the web portal of the Cisco Prime Collaboration Provisioning Tool could allow an unauthenticated, remote attacker to create a denial of service (DoS) condition for individual users. The vulnerability is due to weak login controls. An attacker could exploit this vulnerability by using a brute-force attack (Repeated Bad Login Attempts). A successful exploit could allow the attacker to restrict user access. Manual administrative intervention is required to restore access. Cisco Bug IDs: CSCvd07264. |
| CVE-2012-2441 | High | 2012-04-28 | Not applicable | Working exploit published | RuggedCom Rugged Operating System (ROS) before 3.3 has a factory account with a password derived from the MAC Address field in a banner, which makes it easier for remote attackers to obtain access by performing a calculation on this address value, and then establishing a (1) SSH or (2) HTTPS session, a different vulnerability than CVE-2012-1803. |