Weak Password Requirements

The product does not require that users should have strong passwords, which makes it easier for attackers to compromise user accounts.

CVEs (264)

CVE VENDORS PRODUCTS UPDATED PUBLISHED CVSS
CVE-2022-27558 1Hcltech 2Domino Hcl Inotes Jun 17, 2026 Aug 29, 2022 N/A· v4 7.5 HIGH· v3 N/A· v2 HCL iNotes is susceptible to a Broken Password Strength Checks vulnerability. Custom password policies are not enforced on certain iNotes forms which could allow users to set weak passwords, leading to easier cracking.
CVE-2022-37158 1Iocoder 1Ruoyi Vue Pro Jun 17, 2026 Aug 25, 2022 N/A· v4 9.8 CRITICAL· v3 N/A· v2 RuoYi v3.8.3 has a Weak password vulnerability in the management system.
CVE-2022-34772 1Tabit 1Tabit Jun 17, 2026 Aug 22, 2022 N/A· v4 8.8 HIGH· v3 N/A· v2 Tabit - password enumeration. Description: Tabit - password enumeration. The passwords for the Tabit system is a 4 digit OTP. One can resend OTP and try logging in indefinitely. Once again, this is an example of OWASP: A...Show more Tabit - password enumeration. Description: Tabit - password enumeration. The passwords for the Tabit system is a 4 digit OTP. One can resend OTP and try logging in indefinitely. Once again, this is an example of OWASP: API4 - Rate limiting.Show less
CVE-2022-2927 1Notrinos 1Notrinoserp Jun 17, 2026 Aug 22, 2022 N/A· v4 9.8 CRITICAL· v3 N/A· v2 Weak Password Requirements in GitHub repository notrinos/notrinoserp prior to 0.7.
CVE-2022-34615 1Mealie 1Mealie Jun 17, 2026 Aug 19, 2022 N/A· v4 9.8 CRITICAL· v3 N/A· v2 Mealie 1.0.0beta3 employs weak password requirements which allows attackers to potentially gain unauthorized access to the application via brute-force attacks.
CVE-2022-35280 1Ibm 1Robotic Process Automation For Cloud Pak Jun 17, 2026 Aug 10, 2022 N/A· v4 9.8 CRITICAL· v3 N/A· v2 IBM Robotic Process Automation 21.0.0, 21.0.1, and 21.0.2 does not require that users should have strong passwords by default, which makes it easier for attackers to compromise user accounts. IBM X-Force ID: 230634.
CVE-2022-35143 1Raneto Project 1Raneto Jun 17, 2026 Aug 4, 2022 N/A· v4 9.8 CRITICAL· v3 N/A· v2 Renato v0.17.0 employs weak password complexity requirements, allowing attackers to crack user passwords via brute-force attacks.
CVE-2022-36301 1Bosch 1Bf Os Jun 17, 2026 Aug 1, 2022 N/A· v4 7.5 HIGH· v3 N/A· v2 BF-OS version 3.x up to and including 3.83 do not enforce strong passwords which may allow a remote attacker to brute-force the device password.
CVE-2022-26117 1Fortinet 1Fortinac Jun 17, 2026 Jul 18, 2022 N/A· v4 8.8 HIGH· v3 N/A· v2 An empty password in configuration file vulnerability [CWE-258] in FortiNAC version 8.3.7 and below, 8.5.2 and below, 8.5.4, 8.6.0, 8.6.5 and below, 8.7.6 and below, 8.8.11 and below, 9.1.5 and below, 9.2.3 and below may...Show more An empty password in configuration file vulnerability [CWE-258] in FortiNAC version 8.3.7 and below, 8.5.2 and below, 8.5.4, 8.6.0, 8.6.5 and below, 8.7.6 and below, 8.8.11 and below, 9.1.5 and below, 9.2.3 and below may allow an authenticated attacker to access the MySQL databases via the CLI.Show less
CVE-2022-31211 1Infiray 1Iray A8z3 Firmware Jun 17, 2026 Jul 17, 2022 N/A· v4 9.8 CRITICAL· v3 10.0 HIGH· v2 An issue was discovered in Infiray IRAY-A8Z3 1.0.957. There is a blank root password for TELNET by default.
CVE-2022-28377 1Verizon 2Lvskihp Indoorunit Firmware Lvskihp Outdoorunit Firmware Jun 17, 2026 Jul 14, 2022 N/A· v4 7.5 HIGH· v3 N/A· v2 On Verizon 5G Home LVSKIHP InDoorUnit (IDU) 3.4.66.162 and OutDoorUnit (ODU) 3.33.101.0 devices, the CRTC and ODU RPC endpoints rely on a static account username/password for access control. This password can be generate...Show more On Verizon 5G Home LVSKIHP InDoorUnit (IDU) 3.4.66.162 and OutDoorUnit (ODU) 3.33.101.0 devices, the CRTC and ODU RPC endpoints rely on a static account username/password for access control. This password can be generated via a binary included in the firmware, after ascertaining the MAC address of the IDU's base Ethernet interface, and adding the string DEVICE_MANUFACTURER='Wistron_NeWeb_Corp.' to /etc/device_info to replicate the host environment. This occurs in /etc/init.d/wnc_factoryssidkeypwd (IDU).Show less
CVE-2022-1668 1Secheron 1Sepcos Control And Protection Relay Firmware Jun 17, 2026 Jun 24, 2022 N/A· v4 9.8 CRITICAL· v3 10.0 HIGH· v2 Weak default root user credentials allow remote attackers to easily obtain OS superuser privileges over the open TCP port for SSH.
CVE-2022-30325 1Trendnet 1Tew 831dr Firmware Jun 17, 2026 Jun 16, 2022 N/A· v4 8.8 HIGH· v3 3.3 LOW· v2 An issue was found on TRENDnet TEW-831DR 1.0 601.130.1.1356 devices. The default pre-shared key for the Wi-Fi networks is the same for every router except for the last four digits. The device default pre-shared key for b...Show more An issue was found on TRENDnet TEW-831DR 1.0 601.130.1.1356 devices. The default pre-shared key for the Wi-Fi networks is the same for every router except for the last four digits. The device default pre-shared key for both 2.4 GHz and 5 GHz networks can be guessed or brute-forced by an attacker within range of the Wi-Fi network.Show less
CVE-2022-2098 1Kromit 1Titra Jun 17, 2026 Jun 16, 2022 N/A· v4 9.8 CRITICAL· v3 5.0 MEDIUM· v2 Weak Password Requirements in GitHub repository kromitgmbh/titra prior to 0.78.1.
CVE-2022-29729 1Verizon 14g Lte Network Extender Firmware Jun 17, 2026 Jun 2, 2022 N/A· v4 7.5 HIGH· v3 5.0 MEDIUM· v2 Verizon 4G LTE Network Extender GA4.38 - V0.4.038.2131 utilizes a weak default admin password generation algorithm which generates passwords that are accessible to unauthenticated attackers via the webUI login page.
CVE-2022-29098 1Dell 1Powerscale Onefs Jun 17, 2026 Jun 1, 2022 N/A· v4 7.5 HIGH· v3 5.0 MEDIUM· v2 Dell PowerScale OneFS versions 8.2.0.x through 9.3.0.x, contain a weak password requirement vulnerability. An administrator may create an account with no password. A remote attacker may potentially exploit this leading t...Show more Dell PowerScale OneFS versions 8.2.0.x through 9.3.0.x, contain a weak password requirement vulnerability. An administrator may create an account with no password. A remote attacker may potentially exploit this leading to a user account compromise.Show less
CVE-2022-1775 1Trudesk Project 1Trudesk Jun 17, 2026 May 20, 2022 N/A· v4 9.8 CRITICAL· v3 7.5 HIGH· v2 Weak Password Requirements in GitHub repository polonel/trudesk prior to 1.2.2.
CVE-2022-29700 1Zammad 1Zammad Jun 17, 2026 Apr 27, 2022 N/A· v4 7.5 HIGH· v3 5.0 MEDIUM· v2 A lack of password length restriction in Zammad v5.1.0 allows for the creation of extremely long passwords which can cause a Denial of Service (DoS) during password verification.
CVE-2022-1039 1Redlion 1Da50n Firmware Jun 17, 2026 Apr 20, 2022 N/A· v4 9.8 CRITICAL· v3 10.0 HIGH· v2 The weak password on the web user interface can be exploited via HTTP or HTTPS. Once such access has been obtained, the other passwords can be changed. The weak password on Linux accounts can be accessed via SSH or Telne...Show more The weak password on the web user interface can be exploited via HTTP or HTTPS. Once such access has been obtained, the other passwords can be changed. The weak password on Linux accounts can be accessed via SSH or Telnet, the former of which is by default enabled on trusted interfaces. While the SSH service does not support root login, a user logging in using either of the other Linux accounts may elevate to root access using the su command if they have access to the associated password.Show less
CVE-2022-1236 1Weseek 1Growi Jun 17, 2026 Apr 5, 2022 N/A· v4 6.5 MEDIUM· v3 6.4 MEDIUM· v2 Weak Password Requirements in GitHub repository weseek/growi prior to v5.0.0.

Previous 1...789...14 Next