CWE-798 · Use of Hard-coded Credentials (page 11)
Page 11 of 18 — CVEs classified under CWE-798, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2021-45106 | Medium | 6.5 | 2022-02-09 | A vulnerability has been identified in SICAM TOOLBOX II (All versions). Affected applications use a circumventable access control within a database service. Th… |
CVE-2021-42833 | Critical | 9.3 | 2022-02-07 | A Use of Hardcoded Credentials vulnerability exists in AquaView versions 1.60, 7.x, and 8.x that could allow an authenticated local attacker to manipulate user… |
CVE-2022-22987 | Critical | 9.8 | 2022-02-04 | The affected product has a hardcoded private key available inside the project folder, which may allow an attacker to achieve Web Server login and perform furth… |
CVE-2022-22722 | High | 7.5 | 2022-02-04 | A CWE-798: Use of Hard-coded Credentials vulnerability exists that could result in information disclosure. If an attacker were to obtain the SSH cryptographic… |
CVE-2021-42635 | High | 8.1 | 2022-01-31 | PrinterLogic Web Stack versions 19.1.1.13 SP9 and below use a hardcoded APP_KEY value, leading to pre-auth remote code execution. |
CVE-2020-36064 | Critical | 9.8 | 2022-01-31 | Online Course Registration v1.0 was discovered to contain hardcoded credentials in the source code which allows attackers access to the control panel if compro… |
CVE-2022-21199 | Medium | 5.9 | 2022-01-28 | An information disclosure vulnerability exists due to the hardcoded TLS key of reolink RLC-410W v3.0.0.136_20121102. A specially-crafted man-in-the-middle atta… |
CVE-2021-44464 | Medium | 6.3 | 2022-01-21 | Vigilant Software Suite (Mastermed Dashboard) version 2.0.1.3 contains service credentials likely to be common across all instances. An attacker in possession… |
CVE-2021-23233 | High | 7.3 | 2022-01-21 | Sensitive endpoints in Fresenius Kabi Agilia Link+ v3.0 and prior can be accessed without any authentication information such as the session cookie. An attacke… |
CVE-2022-22928 | Critical | 9.8 | 2022-01-21 | MCMS v5.2.4 was discovered to have a hardcoded shiro-key, allowing attackers to exploit the key and execute arbitrary code. |
CVE-2021-23842 | Medium | 5.7 | 2022-01-19 | Communication to the AMC2 uses a state-of-the-art cryptographic algorithm for symmetric encryption called Blowfish. An attacker could retrieve the key from the… |
CVE-2022-0131 | Low | 3.3 | 2022-01-17 | Jimoty App for Android versions prior to 3.7.42 uses a hard-coded API key for an external service. By exploiting this vulnerability, API key for an external se… |
CVE-2022-22056 | Critical | 9.8 | 2022-01-14 | The Le-yan dental management system contains a hard-coded credentials vulnerability in the web page source code, which allows an unauthenticated remote attacke… |
CVE-2021-43052 | Critical | 9.3 | 2022-01-11 | The Realm Server component of TIBCO Software Inc.'s TIBCO FTL - Community Edition, TIBCO FTL - Developer Edition, and TIBCO FTL - Enterprise Edition contains a… |
CVE-2022-21669 | Critical | 9.1 | 2022-01-11 | PuddingBot is a group management bot. In version 0.0.6-b933652 and prior, the bot token is publicly exposed in main.py, making it accessible to malicious actor… |
CVE-2021-45033 | High | 8.8 | 2022-01-11 | A vulnerability has been identified in CP-8000 MASTER MODULE WITH I/O -25/+70°C (All versions < V16.20), CP-8000 MASTER MODULE WITH I/O -40/+70°C (All versions… |
CVE-2022-22845 | Critical | 9.8 | 2022-01-10 | QXIP SIPCAPTURE homer-app before 1.4.28 for HOMER 7.x has the same 167f0db2-f83e-4baa-9736-d56064a5b415 JWT secret key across different customers' installation… |
CVE-2021-45458 | High | 7.5 | 2022-01-06 | Apache Kylin provides encryption classes PasswordPlaceholderConfigurer to help users encrypt their passwords. In the encryption algorithm used by this encrypti… |
CVE-2021-45913 | High | 7.2 | 2022-01-04 | A hardcoded key in ControlUp Real-Time Agent (cuAgent.exe) before 8.2.5 may allow a potential attacker to run OS commands via a WCF channel. |
CVE-2021-45732 | High | 8.8 | 2021-12-30 | Netgear Nighthawk R6700 version 1.0.4.120 makes use of a hardcoded credential. It does not appear that normal users are intended to be able to manipulate confi… |
CVE-2021-20170 | High | 8.8 | 2021-12-30 | Netgear RAX43 version 1.0.3.96 makes use of hardcoded credentials. It does not appear that normal users are intended to be able to manipulate configuration bac… |
CVE-2021-20155 | Critical | 9.8 | 2021-12-30 | Trendnet AC2600 TEW-827DRU version 2.08B01 makes use of hardcoded credentials. It is possible to backup and restore device configurations via the management we… |
CVE-2021-20132 | High | 8.8 | 2021-12-30 | Quagga Services on D-Link DIR-2640 less than or equal to version 1.11B02 use default hard-coded credentials, which can allow a remote attacker to gain administ… |
CVE-2021-35232 | Medium | 6.8 | 2021-12-27 | Hard coded credentials discovered in SolarWinds Web Help Desk product. Through these credentials, the attacker with local access to the Web Help Desk host mach… |
CVE-2021-32993 | High | 8.1 | 2021-12-27 | IntelliBridge EC 40 and 60 Hub (C.00.04 and prior) contains hard-coded credentials, such as a password or a cryptographic key, which it uses for its own inboun… |
CVE-2021-45522 | Medium | 6.1 | 2021-12-26 | NETGEAR XR1000 devices before 1.0.0.58 are affected by a hardcoded password. |
CVE-2021-45521 | High | 7.4 | 2021-12-26 | Certain NETGEAR devices are affected by a hardcoded password. This affects RBK352 before 4.4.0.10, RBR350 before 4.4.0.10, and RBS350 before 4.4.0.10. |
CVE-2021-45520 | Critical | 9.6 | 2021-12-26 | Certain NETGEAR devices are affected by a hardcoded password. This affects RBK352 before 4.4.0.10, RBR350 before 4.4.0.10, and RBS350 before 4.4.0.10. |
CVE-2021-44207 | High | 8.1 | 2021-12-21 | Acclaim USAHERDS through 7.4.0.1 uses hard-coded credentials. |
CVE-2021-41028 | High | 8.2 | 2021-12-16 | A combination of a use of hard-coded cryptographic key vulnerability [CWE-321] in FortiClientEMS 7.0.1 and below, 6.4.6 and below and an improper certificate v… |
CVE-2021-26108 | High | 7.5 | 2021-12-08 | A use of hard-coded cryptographic key vulnerability in the SSLVPN of FortiOS before 7.0.1 may allow an attacker to retrieve the key by reverse engineering. |
CVE-2021-43044 | Critical | 9.8 | 2021-12-06 | An issue was discovered in Kaseya Unitrends Backup Appliance before 10.5.5. The SNMP daemon was configured with a weak default community. |
CVE-2021-43284 | High | 7.8 | 2021-11-30 | An issue was discovered on Victure WR1200 devices through 1.0.3. The root SSH password never gets updated from its default value of admin. This enables an atta… |
CVE-2021-43282 | Medium | 6.5 | 2021-11-30 | An issue was discovered on Victure WR1200 devices through 1.0.3. The default Wi-Fi WPA2 key is advertised to anyone within Wi-Fi range through the router's MAC… |
CVE-2021-26611 | High | 8.1 | 2021-11-26 | HejHome GKW-IC052 IP Camera contained a hard-coded credentials vulnerability. This issue allows remote attackers to operate the IP Camera.(reboot, factory rese… |
CVE-2021-40519 | Critical | 10.0 | 2021-11-10 | Airangel HSMX Gateway devices through 5.2.04 have Hard-coded Database Credentials. |
CVE-2021-43136 | Critical | 9.8 | 2021-11-10 | An authentication bypass issue in FormaLMS <= 2.4.4 allows an attacker to bypass the authentication mechanism and obtain a valid access to the platform. |
CVE-2021-43575 | Medium | 5.5 | 2021-11-09 | KNX ETS6 through 6.0.0 uses the hard-coded password ETS5Password, with a salt value of Ivan Medvedev, allowing local users to read project information, a simil… |
CVE-2021-40119 | Critical | 9.8 | 2021-11-04 | A vulnerability in the key-based SSH authentication mechanism of Cisco Policy Suite could allow an unauthenticated, remote attacker to log in to an affected sy… |
CVE-2021-38461 | High | 8.2 | 2021-10-22 | The affected product uses a hard-coded blowfish key for encryption/decryption processes. The key can be easily extracted from binaries. |
CVE-2021-41320 | Medium | 5.5 | 2021-10-15 | A technical user has hardcoded credentials in Wallstreet Suite TRM 7.4.83 (64-bit edition) with higher privilege than the average authenticated user. NOTE: the… |
CVE-2021-38456 | Critical | 9.8 | 2021-10-12 | A use of hard-coded password vulnerability in the Moxa MXview Network Management software Versions 3.x to 3.2.2 may allow an attacker to gain access through ac… |
CVE-2021-34757 | Medium | 4.9 | 2021-10-06 | Multiple vulnerabilities in Cisco Business 220 Series Smart Switches firmware could allow an attacker with Administrator privileges to access sensitive login c… |
CVE-2021-34744 | Medium | 4.9 | 2021-10-06 | Multiple vulnerabilities in Cisco Business 220 Series Smart Switches firmware could allow an attacker with Administrator privileges to access sensitive login c… |
CVE-2021-33583 | Critical | 9.8 | 2021-09-30 | REINER timeCard 6.05.07 installs a Microsoft SQL Server with an sa password that is hardcoded in the TCServer.jar file. |
CVE-2021-41299 | Critical | 9.8 | 2021-09-30 | ECOA BAS controller is vulnerable to hard-coded credentials within its Linux distribution image, thus remote attackers can obtain administrator’s privilege wit… |
CVE-2021-41828 | High | 7.5 | 2021-09-30 | Zoho ManageEngine Remote Access Plus before 10.1.2121.1 has hardcoded credentials associated with resetPWD.xml. |
CVE-2021-41827 | High | 7.5 | 2021-09-30 | Zoho ManageEngine Remote Access Plus before 10.1.2121.1 has hardcoded credentials for read-only access. The credentials are in the source code that corresponds… |
CVE-2020-4690 | Critical | 9.8 | 2021-09-23 | IBM Security Guardium 11.3 contains hard-coded credentials, such as a password or cryptographic key, which it uses for its own inbound authentication, outbound… |
CVE-2021-21913 | Critical | 9.8 | 2021-09-23 | An information disclosure vulnerability exists in the WiFi Smart Mesh functionality of D-LINK DIR-3040 1.13B03. A specially-crafted network request can lead to… |
CVE-2021-34571 | Medium | 6.5 | 2021-09-16 | Multiple Wireless M-Bus devices by Enbra use Hard-coded Credentials in Security mode 5 without an option to change the encryption key. An adversary can learn a… |
CVE-2021-28813 | Critical | 9.6 | 2021-09-10 | A vulnerability involving insecure storage of sensitive information has been reported to affect QSW-M2116P-2T2S and QNAP switches running QuNetSwitch. If explo… |
CVE-2021-28912 | High | 7.2 | 2021-09-09 | BAB TECHNOLOGIE GmbH eibPort V3. Each device has its own unique hard coded and weak root SSH key passphrase known as 'eibPort string'. This is usable and the f… |
CVE-2021-33484 | High | 7.5 | 2021-09-07 | An issue was discovered in CommentsService.ashx in OnyakTech Comments Pro 3.8. An attacker can download a copy of the installer, decompile it, and discover a h… |
CVE-2021-40494 | Critical | 9.8 | 2021-09-03 | A Hardcoded JWT Secret Key in metadata.py in AdaptiveScale LXDUI through 2.1.3 allows attackers to gain admin access to the host system. |
CVE-2021-36234 | Medium | 5.5 | 2021-08-31 | Use of a hard-coded cryptographic key in MIK.starlight 7.9.5.24363 allows local users to decrypt credentials via unspecified vectors. |
CVE-2021-34565 | Critical | 9.8 | 2021-08-31 | In PEPPERL+FUCHS WirelessHART-Gateway 3.0.7 to 3.0.9 the SSH and telnet services are active with hard-coded credentials. |
CVE-2021-29728 | Medium | 4.9 | 2021-08-30 | IBM Sterling Secure Proxy 6.0.1, 6.0.2, 2.4.3.2, and 3.4.3.2 contains hard-coded credentials, such as a password or cryptographic key, which it uses for its ow… |
CVE-2021-39615 | Critical | 9.8 | 2021-08-23 | D-Link DSR-500N version 1.02 contains hard-coded credentials for undocumented user accounts in the '/etc/passwd' file.If an attacker succeeds in recovering the… |
CVE-2021-39614 | Critical | 9.8 | 2021-08-23 | D-Link DVX-2000MS contains hard-coded credentials for undocumented user accounts in the '/etc/passwd' file. As weak passwords have been used, the plaintext pas… |
CVE-2021-39613 | Critical | 9.8 | 2021-08-23 | D-Link DVG-3104MS version 1.0.2.0.3, 1.0.2.0.4, and 1.0.2.0.4E contains hard-coded credentials for undocumented user accounts in the '/etc/passwd' file. As wea… |
CVE-2021-39245 | High | 7.5 | 2021-08-23 | Hardcoded .htaccess Credentials for getlogs.cgi exist on Altus Nexto, Nexto Xpress, and Hadron Xtorm devices. This affects Nexto NX3003 1.8.11.0, Nexto NX3004… |
CVE-2021-32588 | Critical | 9.8 | 2021-08-18 | A use of hard-coded credentials (CWE-798) vulnerability in FortiPortal versions 5.2.5 and below, 5.3.5 and below, 6.0.4 and below, versions 5.1.x and 5.0.x may… |
CVE-2020-25565 | Critical | 9.8 | 2021-08-11 | In SapphireIMS 5.0, it is possible to use the hardcoded credential in clients (username: sapphire, password: ims) and gain access to the portal. Once the acces… |
CVE-2020-25561 | High | 7.8 | 2021-08-11 | SapphireIMS 5 utilized default sapphire:ims credentials to connect the client to server. This credential is saved in ServerConf.config file in the client. |
CVE-2020-25560 | Critical | 9.8 | 2021-08-11 | In SapphireIMS 5.0, it is possible to use the hardcoded credential in clients (username: sapphire, password: ims) and gain access to the portal. Once the acces… |
CVE-2013-6276 | Critical | 9.8 | 2021-08-09 | QNAP F_VioCard 2312 and F_VioGate 2308 have hardcoded entries in authorized_keys files. NOTE: 1. All active models are not affected. The last affected model wa… |
CVE-2021-27952 | Critical | 9.8 | 2021-08-03 | Hardcoded default root credentials exist on the ecobee3 lite 4.5.81.200 device. This allows a threat actor to gain access to the password-protected bootloader… |
CVE-2021-27503 | Medium | 4.8 | 2021-08-02 | Ypsomed mylife Cloud, mylife Mobile Application, Ypsomed mylife Cloud: All versions prior to 1.7.2, Ypsomed mylife App: All versions prior to 1.7.5,The applica… |
CVE-2021-37163 | Critical | 9.8 | 2021-08-02 | An insecure permissions issue was discovered in HMI3 Control Panel in Swisslog Healthcare Nexus operated by released versions of software before Nexus Software… |
CVE-2021-37555 | Critical | 9.8 | 2021-07-26 | TX9 Automatic Food Dispenser v3.2.57 devices allow access to a shell as root/superuser, a related issue to CVE-2019-16734. To connect, the telnet service is us… |
CVE-2021-31579 | High | 8.2 | 2021-07-22 | Akkadian Provisioning Manager Engine (PME) ships with a hard-coded credential, akkadianuser:haakkadianpassword. This issue was resolved in Akkadian OVA applian… |
CVE-2021-22730 | Critical | 9.8 | 2021-07-21 | A CWE-798: Use of Hard-coded Credentials vulnerability exists in EVlink City (EVC1S22P4 / EVC1S7P4 all versions prior to R8 V3.4.0.1), EVlink Parking (EVW2 / E… |
CVE-2021-22707 | Critical | 9.8 | 2021-07-21 | A CWE-798: Use of Hard-coded Credentials vulnerability exists in EVlink City (EVC1S22P4 / EVC1S7P4 all versions prior to R8 V3.4.0.1), EVlink Parking (EVW2 / E… |
CVE-2020-5349 | Critical | 9.8 | 2021-07-19 | Dell EMC Networking S4100 and S5200 Series Switches manufactured prior to February 2020 contain a hardcoded credential vulnerability. A remote unauthenticated… |
CVE-2021-36799 | High | 8.8 | 2021-07-19 | KNX ETS5 through 5.7.6 uses the hard-coded password ETS5Password, with a salt value of Ivan Medvedev, allowing local users to read project information. NOTE: T… |
CVE-2021-35961 | Critical | 9.8 | 2021-07-16 | Dr. ID Door Access Control and Personnel Attendance Management system uses the hard-code admin default credentials that allows remote attackers to access the s… |
CVE-2021-21820 | Critical | 9.8 | 2021-07-16 | A hard-coded password vulnerability exists in the Libcli Test Environment functionality of D-LINK DIR-3040 1.13B03. A specially crafted network request can lea… |
CVE-2021-21818 | High | 7.5 | 2021-07-16 | A hard-coded password vulnerability exists in the Zebra IP Routing Manager functionality of D-LINK DIR-3040 1.13B03. A specially crafted network request can le… |
CVE-2021-0279 | High | 8.6 | 2021-07-15 | Juniper Networks Contrail Cloud (CC) releases prior to 13.6.0 have RabbitMQ service enabled by default with hardcoded credentials. The messaging services of Ra… |
CVE-2021-20537 | Medium | 6.5 | 2021-07-15 | IBM Security Verify Access Docker 10.0.0 contains hard-coded credentials, such as a password or cryptographic key, which it uses for its own inbound authentica… |
CVE-2021-34688 | Low | 3.3 | 2021-07-15 | iDrive RemotePC before 7.6.48 on Windows allows information disclosure. A locally authenticated attacker can read an encrypted version of the system's Personal… |
CVE-2021-20748 | High | 7.5 | 2021-07-14 | Retty App for Android versions prior to 4.8.13 and Retty App for iOS versions prior to 4.11.14 uses a hard-coded API key for an external service. By exploiting… |
CVE-2021-1576 | High | 8.8 | 2021-07-08 | Multiple vulnerabilities in the web-based management interface of Cisco Business Process Automation (BPA) could allow an authenticated, remote attacker to elev… |
CVE-2021-1574 | High | 8.8 | 2021-07-08 | Multiple vulnerabilities in the web-based management interface of Cisco Business Process Automation (BPA) could allow an authenticated, remote attacker to elev… |
CVE-2021-33220 | High | 7.8 | 2021-07-07 | An issue was discovered in CommScope Ruckus IoT Controller 1.7.1.0 and earlier. Hard-coded API Keys exist. |
CVE-2021-33219 | Critical | 9.8 | 2021-07-07 | An issue was discovered in CommScope Ruckus IoT Controller 1.7.1.0 and earlier. There are Hard-coded Web Application Administrator Passwords for the admin and… |
CVE-2021-33218 | Critical | 9.8 | 2021-07-07 | An issue was discovered in CommScope Ruckus IoT Controller 1.7.1.0 and earlier. There are Hard-coded System Passwords that provide shell access. |
CVE-2021-32535 | Critical | 9.8 | 2021-07-07 | The vulnerability of hard-coded default credentials in QSAN SANOS allows unauthenticated remote attackers to obtain administrator’s permission and execute arbi… |
CVE-2021-32525 | Critical | 9.1 | 2021-07-07 | The same hard-coded password in QSAN Storage Manager's in the firmware allows remote attackers to access the control interface with the administrator’s credent… |
CVE-2021-32521 | High | 7.3 | 2021-07-07 | Use of MAC address as an authenticated password in QSAN Storage Manager, XEVO, SANOS allows local attackers to escalate privileges. Suggest contacting with QSA… |
CVE-2021-32520 | Critical | 9.8 | 2021-07-07 | Use of hard-coded cryptographic key vulnerability in QSAN Storage Manager allows attackers to obtain users’ credentials and related permissions. Suggest contac… |
CVE-2021-24005 | Medium | 4.0 | 2021-07-06 | Usage of hard-coded cryptographic keys to encrypt configuration files and debug logs in FortiAuthenticator versions before 6.3.0 may allow an attacker with acc… |
CVE-2021-31505 | Medium | 6.8 | 2021-06-29 | This vulnerability allows attackers with physical access to escalate privileges on affected installations of Arlo Q Plus 1.9.0.3_278. Authentication is not req… |
CVE-2021-33540 | High | 7.3 | 2021-06-25 | In certain devices of the Phoenix Contact AXL F BK and IL BK product families an undocumented password protected FTP access to the root directory exists. |
CVE-2021-33531 | High | 8.8 | 2021-06-25 | In Weidmueller Industrial WLAN devices in multiple versions an exploitable use of hard-coded credentials vulnerability exists in multiple iw_* utilities. The d… |
CVE-2021-33529 | High | 7.5 | 2021-06-25 | In Weidmueller Industrial WLAN devices in multiple versions the usage of hard-coded cryptographic keys within the service agent binary allows for the decryptio… |
CVE-2021-34812 | Medium | 5.8 | 2021-06-18 | Use of hard-coded credentials vulnerability in php component in Synology Calendar before 2.4.0-0761 allows remote attackers to obtain sensitive information via… |
CVE-2021-31477 | High | 7.3 | 2021-06-16 | This vulnerability allows remote attackers to execute arbitrary code on affected installations of GE Reason RPV311 14A03. Authentication is not required to exp… |
CVE-2020-25752 | Medium | 5.3 | 2021-06-16 | An issue was discovered on Enphase Envoy R3.x and D4.x devices. There are hardcoded web-panel login passwords for the installer and Enphase accounts. The passw… |