Empty Password in Configuration File
CWE-258
Using an empty string as a password is insecure.
We track 8 vulnerabilities of this type. 100% are rated high or critical, and the average CVSS score is 8.8.
Latest Empty Password in Configuration File vulnerabilities
- 9.8 Critical severity
blueprintue-self-hosted-edition: Empty Password in Configuration File
blueprintUE Self-Hosted Edition before 4.3.7 contains an insecure default configuration in its Docker Compose examples that sets MYSQL_ALLOW_EMPTY_PASSWORD=yes in database.env and publishes MariaDB on port 3306. Unauthenticated attackers reaching the Docker ho
- 9.8 Critical severity
DHP-W610AV: Empty Password in Configuration File
A vulnerability has been found in D-Link DHP-W610AV 1.02EUb03. The impacted element is the function login_prepare_hnap of the file etc/defnodes/defaultvalue.xml of the component HNAP Login. The manipulation of the argument Password leads to empty password in c
- 7.5 High severity
HMT.CM2507 Firmware: Empty Password in Configuration File
CM2507 IP cameras accept an empty password for a privileged account exposed through its ONVIF management service. An attacker with network access to the affected device could access privileged management functions and obtain device, user, media-profile, and st
- 7.3 High severity
BullSequana XH3406: Empty Password in Configuration File
Under certain circumstances such as reset to factory default operation, the BMC root account is made active without a password on BullSequana XH3406 and XH3515.
- 9.8 Critical severity
cockroach-k8s-request-cert: Empty Password in Configuration File
Cockroach Labs cockroach-k8s-request-cert Empty Root Password Authentication Bypass Vulnerability. This vulnerability could allow remote attackers to bypass authentication on systems that use the affected version of the Cockroach Labs cockroach-k8s-request-cer
- 8.8 High severity
ACERA 9010-08: Empty Password in Configuration File
The password is empty in the initial configuration of ACERA 9010-08 firmware v02.04 and earlier, and ACERA 9010-24 firmware v02.04 and earlier. An unauthenticated attacker may log in to the product with no password, and obtain and/or alter information such as
- 7.3 High severity
Security Verify Access Appliance: Weak Password Requirements
IBM Security Access Manager Container (IBM Security Verify Access Appliance 10.0.0.0 through 10.0.6.1 and IBM Security Verify Access Docker 10.0.0.0 through 10.0.6.1) could allow a remote user to log into the server due to a user account with an empty password
- 9.8 Critical severity
SAP Commerce: Empty Password in Configuration File
SAP Commerce Cloud may accept an empty passphrase for user ID and passphrase authentication, allowing users to log into the system without a passphrase.