Filtered by CWE-255
Filtered by vendor Subscriptions
Total 756 CVE
CVE Vendors Products Updated CVSS v3.1
CVE-2008-3235 1 Ibm 1 Websphere Application Server 2024-11-21 N/A
Unspecified vulnerability in the PropFilePasswordEncoder utility in the Security component in IBM WebSphere Application Server (WAS) 5.1 before 5.1.1.19 has unknown impact and attack vectors.
CVE-2008-3067 1 Suse 1 Opensuse 2024-11-21 N/A
sudo in SUSE openSUSE 10.3 does not clear the stdin buffer when password entry times out, which might allow local users to obtain a password by reading stdin from the parent process after a sudo child process exits.
CVE-2008-3059 1 Octeth 1 Oempro 2024-11-21 N/A
member/settings_account.php in Octeth Oempro 3.5.5.1, and possibly other versions before 4, uses cleartext to transmit a password entered in the FormValue_Password field, which makes it easier for remote attackers to obtain sensitive information by sniffing the network, related to the "Settings - Account Information" tab.
CVE-2008-3009 1 Microsoft 8 Windows 2000, Windows Media Format Runtime, Windows Media Player and 5 more 2024-11-21 N/A
Microsoft Windows Media Player 6.4, Windows Media Format Runtime 7.1 through 11, and Windows Media Services 4.1, 9, and 2008 do not properly use the Service Principal Name (SPN) identifier when validating replies to authentication requests, which allows remote servers to execute arbitrary code via vectors that employ NTLM credential reflection, aka "SPN Vulnerability."
CVE-2008-2857 1 Alstrasoft 1 Askme 2024-11-21 N/A
AlstraSoft AskMe Pro 2.1 and earlier stores passwords in cleartext in a MySQL database, which allows context-dependent attackers to obtain sensitive information.
CVE-2008-2368 1 Redhat 1 Certificate System 2024-11-21 N/A
Red Hat Certificate System 7.2 stores passwords in cleartext in the UserDirEnrollment log, the RA wizard installer log, and unspecified other debug log files, and uses weak permissions for these files, which allows local users to discover passwords by reading the files.
CVE-2008-2312 1 Apple 2 Mac Os X, Mac Os X Server 2024-11-21 N/A
Network Preferences in Apple Mac OS X 10.4.11 stores PPP passwords in cleartext in a world-readable file, which allows local users to obtain sensitive information by reading this file.
CVE-2008-2291 1 Symantec 1 Altiris Deployment Solution 2024-11-21 N/A
axengine.exe in Symantec Altiris Deployment Solution 6.8.x and 6.9.x before 6.9.176 generates credentials with a fixed salt or without any salt, which makes it easier for remote attackers to guess encrypted domain credentials.
CVE-2008-2279 1 Freelance Auction 1 Freelance Auction Script 2024-11-21 N/A
Freelance Auction Script 1.0 stores user passwords in plaintext in the tbl_users table, which allows attackers to gain privileges by reading the table.
CVE-2008-1970 1 Mucommander 1 Mucommander 2024-11-21 N/A
muCommander before 0.8.2 stores credentials.xml with insecure permissions, which allows local users to obtain credentials.
CVE-2008-1880 2 Firebird, Gentoo 2 Firebird, Linux 2024-11-21 N/A
The default configuration of Firebird before 2.0.3.12981.0-r6 on Gentoo Linux sets the ISC_PASSWORD environment variable before starting Firebird, which allows remote attackers to bypass SYSDBA authentication and obtain sensitive database information via an empty password.
CVE-2008-1676 2 Netscape, Redhat 2 Certificate Management System, Certificate System 2024-11-21 N/A
Red Hat PKI Common Framework (rhpki-common) in Red Hat Certificate System (aka Certificate Server or RHCS) 7.1 through 7.3, and Netscape Certificate Management System 6.x, does not recognize Certificate Authority profile constraints on Extensions, which might allow remote attackers to bypass intended restrictions and conduct man-in-the-middle attacks by submitting a certificate signing request (CSR) and using the resulting certificate.
CVE-2008-1543 1 Airspan 7 Easy St, Easy St-2, Prost and 4 more 2024-11-21 N/A
The Advanced User Interface Pages in the ProST Web Management component on the Airspan WiMAX ProST have a certain default User ID and password, which makes it easier for remote attackers to obtain partial administrative access, a different vulnerability than CVE-2008-1262.
CVE-2008-1542 1 Airspan 1 Base Station Distribution Unit 2024-11-21 N/A
Airspan Base Station Distribution Unit (BSDU) has "topsecret" as its password for the root account, which allows remote attackers to obtain administrative access via a telnet login, a different vulnerability than CVE-2008-1262.
CVE-2008-1529 1 Zyxel 3 Prestige 660, Prestige 661, Zynos 2024-11-21 N/A
ZyXEL Prestige routers have a minimum password length for the admin account that is too small, which makes it easier for remote attackers to guess passwords via brute force methods.
CVE-2008-1396 1 Plone 1 Plone Cms 2024-11-21 N/A
Plone CMS 3.x uses invariant data (a client username and a server secret) when calculating an HMAC-SHA1 value for an authentication cookie, which makes it easier for remote attackers to gain permanent access to an account by sniffing the network.
CVE-2008-1394 1 Plone 1 Plone Cms 2024-11-21 N/A
Plone CMS before 3 places a base64 encoded form of the username and password in the __ac cookie for all user accounts, which makes it easier for remote attackers to obtain access by sniffing the network.
CVE-2008-1393 1 Plone 1 Plone Cms 2024-11-21 N/A
Plone CMS 3.0.5, and probably other 3.x versions, places a base64 encoded form of the username and password in the __ac cookie for the admin account, which makes it easier for remote attackers to obtain administrative privileges by sniffing the network.
CVE-2008-1390 1 Asterisk 5 Asterisk, Asterisk Appliance Developer Kit, Asterisk Business Edition and 2 more 2024-11-21 N/A
The AsteriskGUI HTTP server in Asterisk Open Source 1.4.x before 1.4.19-rc3 and 1.6.x before 1.6.0-beta6, Business Edition C.x.x before C.1.6, AsteriskNOW before 1.0.2, Appliance Developer Kit before revision 104704, and s800i 1.0.x before 1.1.0.2 generates insufficiently random manager ID values, which makes it easier for remote attackers to hijack a manager session via a series of ID guesses.
CVE-2008-1218 1 Dovecot 1 Dovecot 2024-11-21 N/A
Argument injection vulnerability in Dovecot 1.0.x before 1.0.13, and 1.1.x before 1.1.rc3, when using blocking passdbs, allows remote attackers to bypass the password check via a password containing TAB characters, which are treated as argument delimiters that enable the skip_password_check field to be specified.