User has no password set
That is definite a security hole. That's because mysql was installed that way.

To remove those entries, please run these lines

DELETE FROM mysql.user WHERE user='' or password='';
FLUSH PRIVILEGES;


Here are three(3) past posts I wrote on how and why to do such cleanup of mysql.user and mysql.db


Secure method beside phpMyAdmin for remote mysql
MySQL error: Access denied for user &#39;a&#39;@&#39;localhost&#39; (using password: YES)
MySQL : Why are there &quot;test&quot; entries in mysql.db?