CWE-256 Plaintext Storage of a Password
baseThe product stores a password in plaintext within resources such as memory or files.
01
übergeordnete Schwächen
Übergeordnete Klassen, zu denen dies gehört.
02
Schwachstellen (566)
Zugehörige CVEs.
| ID | Schweregrad | ausnutzbar | ||
|---|---|---|---|---|
| CVE-2018-10824US | critical9.8 | Exploit | ||
An issue was discovered on D-Link DWR-116 through 1.06, DIR-140L through 1.02, DIR-640L through 1.02, DWR-512 through 2.02, DWR-712 through 2.02, DWR-912 through 2.02, DWR-921 thro… | ||||
| CVE-1999-0953US | high10.0 | Exploit | ||
WWWBoard stores encrypted passwords in a password file that is under the web root and thus accessible by remote attackers. | ||||
| CVE-2021-32608US | critical9.8 | — | ||
An issue was discovered in Smartstore (aka SmartStoreNET) through 4.1.1. Views/Boards/Partials/_ForumPost.cshtml does not call HtmlUtils.SanitizeHtml on certain text for a forum po… | ||||
| CVE-2007-2149US | high10.0OT hoch | Exploit | ||
Stephen Craton (aka WiredPHP) Chatness 2.5.3 and earlier stores usernames and unencrypted passwords in (1) classes/vars.php and (2) classes/varstuff.php, and recommends 0666 or 077… | ||||
| CVE-2002-2190US | high7.5OT erhöht | Exploit | ||
ArtsCore Studios CuteCast Forum 1.2 stores passwords in plaintext under the web document root, which allows remote attackers to obtain the passwords via an HTTP request to a .user… | ||||
| CVE-1999-0364US | high10.0OT erhöht | — | ||
Microsoft Access 97 stores a database password as plaintext in a foreign mdb, allowing access to data. | ||||
| CVE-1999-0535US | high10.0 | — | ||
A Windows NT account policy for passwords has inappropriate, security-critical settings, e.g. for password length, password age, or uniqueness. | ||||
| CVE-2020-6961US | critical10.0 | — | ||
In ApexPro Telemetry Server, Versions 4.2 and prior, CARESCAPE Telemetry Server v4.2 & prior, Clinical Information Center (CIC) Versions 4.X and 5.X, CARESCAPE Telemetry Server Ver… | ||||
| CVE-2015-8362US | critical9.8OT erhöht | — | ||
The setUpSubtleUserAccount function in /bin/bw on Harman AMX devices before 2015-10-12 has a hardcoded password for the BlackWidow account, which makes it easier for remote attacke… | ||||
| CVE-2006-5912US | high10.0 | — | ||
Unspecified vulnerability in Campware Campsite before 2.6.2 has unknown impact and attack vectors, related to a "Security fix for you-know-what," possibly related to encrypted pass… | ||||
| CVE-2006-2430US | high10.0OT erhöht | — | ||
IBM WebSphere Application Server 5.0.2 and earlier, 5.1.1 and earlier, and 6.0.2 up to 6.0.2.7 records user credentials in plaintext in addNode.log, which allows attackers to gain… | ||||
| CVE-2002-2143US | high7.5OT erhöht | Exploit | ||
The admin.html file in MySimple News 1.0 stores its administrative password in plaintext, which allows remote attackers to gain unauthorized access to the web server by viewing the… | ||||
| CVE-2001-1220US | high10.0OT erhöht | — | ||
D-Link DWL-1000AP Firmware 3.2.28 #483 Wireless LAN Access Point stores the administrative password in plaintext in the default Management Information Base (MIB), which allows remo… | ||||
| CVE-2001-0960US | high10.0OT erhöht | — | ||
Computer Associates ARCserve for NT 6.61 SP2a and ARCserve 2000 7.0 stores the backup agent user name and password in cleartext in the aremote.dmp file in the ARCSERVE$ hidden shar… | ||||
| CVE-2000-0954US | high10.0OT erhöht | — | ||
Shambala Server 4.5 stores passwords in plaintext, which could allow local users to obtain the passwords and compromise the server. | ||||
| CVE-2000-0955US | high7.5 | Exploit | ||
Cisco Virtual Central Office 4000 (VCO/4K) uses weak encryption to store usernames and passwords in the SNMP MIB, which allows an attacker who knows the community name to crack the… | ||||
| CVE-2000-1076US | high10.0OT erhöht | — | ||
Netscape (iPlanet) Certificate Management System 4.2 and Directory Server 4.12 stores the administrative password in plaintext, which could allow local and possibly remote attacker… | ||||
| CVE-1999-0568US | high10.0 | — | ||
rpc.admind in Solaris is not running in a secure mode. | ||||
| CVE-2021-36783US | critical9.9OT erhöht | — | ||
A Insufficiently Protected Credentials vulnerability in SUSE Rancher allows authenticated Cluster Owners, Cluster Members, Project Owners and Project Members to read credentials, p… | ||||
| CVE-2019-14929US | critical9.8 | — | ||
An issue was discovered on Mitsubishi Electric Europe B.V. ME-RTU devices through 2.02 and INEA ME-RTU devices through 3.0. Stored cleartext passwords could allow an unauthenticate… | ||||
03
Quelle
Wo diese Definition veröffentlicht ist.
MITREUS
scry
Schwächen wie diese tauchen in realen, ausnutzbaren Angriffsflächen auf. Sehen Sie mit einem kostenlosen Passiv-Scan, was exponiert ist.
Kostenloser Scan