CWE-798 · Use of Hard-coded Credentials (page 14)
Page 14 of 19 — CVEs classified under CWE-798, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2020-11615 | High | 7.5 | 2020-10-29 | NVIDIA DGX servers, all BMC firmware versions prior to 3.38.30, contain a vulnerability in the AMI BMC firmware in which it uses a hard-coded RC4 cipher key, w… |
CVE-2020-11487 | High | 7.5 | 2020-10-29 | NVIDIA DGX servers, DGX-1 with BMC firmware versions prior to 3.38.30. DGX-2 with BMC firmware versions prior to 1.06.06 and all DGX A100 Servers with all BMC… |
CVE-2020-11483 | Critical | 9.8 | 2020-10-29 | NVIDIA DGX servers, all DGX-1 with BMC firmware versions prior to 3.38.30 and all DGX-2 with BMC firmware versions prior to 1.06.06, contains a vulnerability i… |
CVE-2020-16258 | High | 7.1 | 2020-10-28 | Winston 1.5.4 devices make use of a Monit service (not managed during the normal user process) which is configured with default credentials. |
CVE-2020-11854 | Critical | 9.8 | 2020-10-27 | Arbitrary code execution vlnerability in Operation bridge Manager, Application Performance Management and Operations Bridge (containerized) vulnerability in Mi… |
CVE-2020-27181 | Medium | 6.5 | 2020-10-27 | A hardcoded AES key in CipherUtils.java in the Java applet of konzept-ix publiXone before 2020.015 allows attackers to craft password-reset tokens or decrypt s… |
CVE-2020-26879 | Critical | 9.8 | 2020-10-26 | Ruckus vRioT through 1.5.1.0.21 has an API backdoor that is hardcoded into validate_token.py. An unauthenticated attacker can interact with the service API by… |
CVE-2020-12501 | Critical | 9.8 | 2020-10-15 | Improper Authorization vulnerability of Pepperl+Fuchs P+F Comtrol RocketLinx ES7510-XT, ES8509-XT, ES8510-XT, ES9528-XTv2, ES7506, ES7510, ES7528, ES8508, ES85… |
CVE-2020-24218 | Critical | 9.8 | 2020-10-06 | An issue was discovered on URayTech IPTV/H.264/H.265 video encoders through 1.97. Attackers can log in as root via the password that is hard-coded in the execu… |
CVE-2020-24215 | Critical | 9.8 | 2020-10-06 | An issue was discovered in the box application on HiSilicon based IPTV/H.264/H.265 video encoders. Attackers can use hard-coded credentials in HTTP requests to… |
CVE-2020-24620 | High | 7.8 | 2020-10-01 | Unisys Stealth(core) before 4.0.134 stores passwords in a recoverable format. Therefore, a search of Enterprise Manager can potentially reveal credentials. |
CVE-2019-17098 | Low | 3.5 | 2020-09-30 | Use of hard-coded cryptographic key vulnerability in August Connect Wi-Fi Bridge App, Connect Firmware allows an attacker to decrypt an intercepted payload con… |
CVE-2020-25749 | Critical | 9.8 | 2020-09-25 | The Telnet service of Rubetek cameras RV-3406, RV-3409, and RV-3411 cameras (firmware versions v342, v339) could allow an remote attacker to take full control… |
CVE-2020-4622 | High | 7.5 | 2020-09-22 | IBM Data Risk Manager (iDNA) 2.0.6 contains hard-coded credentials, such as a password or cryptographic key, which it uses for its own inbound authentication… |
CVE-2020-11857 | Critical | 9.8 | 2020-09-22 | An Authorization Bypass vulnerability on Micro Focus Operation Bridge Reporter, affecting version 10.40 and earlier. The vulnerability could allow remote attac… |
CVE-2020-12789 | High | 7.5 | 2020-09-14 | The Secure Monitor in Microchip Atmel ATSAMA5 products use a hardcoded key to encrypt and authenticate secure applets. |
CVE-2018-20432 | Critical | 9.8 | 2020-09-14 | D-Link COVR-2600R and COVR-3902 Kit before 1.01b05Beta01 use hardcoded credentials for telnet connection, which allows unauthenticated attackers to gain privil… |
CVE-2020-25256 | Critical | 9.1 | 2020-09-11 | An issue was discovered in Hyland OnBase 16.0.2.83 and below, 17.0.2.109 and below, 18.0.0.37 and below, 19.8.16.1000 and below and 20.3.10.1000 and below. PKI… |
CVE-2018-17771 | Medium | 6.6 | 2020-09-09 | Ingenico Telium 2 POS terminals have hardcoded FTP credentials. This is fixed in Telium 2 SDK v9.32.03 patch N. |
CVE-2018-17767 | Medium | 6.8 | 2020-09-09 | Ingenico Telium 2 POS terminals have hardcoded PPP credentials. This is fixed in Telium 2 SDK v9.32.03 patch N. |
CVE-2020-24876 | Critical | 9.8 | 2020-09-03 | Use of a hard-coded cryptographic key in Pancake versions < 4.13.29 allows an attacker to forge session cookies, which may lead to remote privilege escalation. |
CVE-2020-24115 | Critical | 9.8 | 2020-08-31 | In projectworlds Online Book Store 1.0 Use of Hard-coded Credentials in source code leads to admin panel access. |
CVE-2019-4694 | Critical | 9.8 | 2020-08-26 | IBM Security Guardium Data Encryption (GDE) 3.0.0.2 contains hard-coded credentials, such as a password or cryptographic key, which it uses for its own inbound… |
CVE-2020-3446 | Critical | 9.8 | 2020-08-26 | A vulnerability in Cisco Virtual Wide Area Application Services (vWAAS) with Cisco Enterprise NFV Infrastructure Software (NFVIS)-bundled images for Cisco ENCS… |
CVE-2020-14510 | Critical | 9.8 | 2020-08-25 | GateManager versions prior to 9.2c, The affected product contains a hard-coded credential for telnet, allowing an unprivileged attacker to execute commands as… |
CVE-2020-24056 | High | 7.5 | 2020-08-21 | A hardcoded credentials vulnerability exists in Verint 5620PTZ Verint_FW_0_42, Verint 4320 V4320_FW_0_23, V4320_FW_0_31, and Verint S5120FD Verint_FW_0_42units… |
CVE-2020-24053 | High | 7.5 | 2020-08-21 | Moog EXO Series EXVF5C-2 and EXVP7C2-3 units have a hardcoded credentials vulnerability. This could cause a confidentiality issue when using the FTP, Telnet, o… |
CVE-2020-24574 | High | 7.8 | 2020-08-21 | The client (aka GalaxyClientService.exe) in GOG GALAXY through 2.0.41 (as of 12:58 AM Eastern, 9/26/21) allows local privilege escalation from any authenticate… |
CVE-2020-16170 | High | 7.5 | 2020-08-11 | Use of Hard-coded Credentials in temi Robox OS prior to 120, temi Android app up to 1.3.7931 allows remote attackers to listen in on any ongoing calls between… |
CVE-2020-13793 | Critical | 9.8 | 2020-08-06 | Unsafe storage of AD credentials in Ivanti DSM netinst 5.1 due to a static, hard-coded encryption key. |
CVE-2020-7352 | High | 8.4 | 2020-08-06 | The GalaxyClientService component of GOG Galaxy runs with elevated SYSTEM privileges in a Windows environment. Due to the software shipping with embedded, stat… |
CVE-2020-4459 | Critical | 9.8 | 2020-08-04 | IBM Security Verify Access 10.7 contains hard-coded credentials, such as a password or cryptographic key, which it uses for its own inbound authentication, out… |
CVE-2020-3382 | Critical | 9.8 | 2020-07-31 | A vulnerability in the REST API of Cisco Data Center Network Manager (DCNM) could allow an unauthenticated, remote attacker to bypass authentication and execut… |
CVE-2019-20025 | Critical | 9.8 | 2020-07-29 | Certain builds of NEC SV9100 software could allow an unauthenticated, remote attacker to log into a device running an affected release with a hardcoded usernam… |
CVE-2020-7515 | High | 7.8 | 2020-07-23 | A CWE-321: Use of hard-coded cryptographic key stored in cleartext vulnerability exists in Easergy Builder V1.4.7.2 and prior which could allow an attacker to… |
CVE-2020-4385 | Critical | 9.8 | 2020-07-22 | IBM Verify Gateway (IVG) 1.0.0 and 1.0.1 contains hard-coded credentials, such as a password or cryptographic key, which it uses for its own inbound authentica… |
CVE-2020-3330 | Critical | 9.8 | 2020-07-16 | A vulnerability in the Telnet service of Cisco Small Business RV110W Wireless-N VPN Firewall Routers could allow an unauthenticated, remote attacker to take fu… |
CVE-2020-5374 | High | 8.8 | 2020-07-14 | Dell EMC OpenManage Integration for Microsoft System Center (OMIMSSC) for SCCM and SCVMM versions prior to 7.2.1 contain a hard-coded cryptographic key vulnera… |
CVE-2020-11951 | Critical | 9.8 | 2020-07-14 | An issue was discovered on Rittal PDU-3C002DEC through 5.17.10 and CMCIII-PU-9333E0FB through 3.17.10 devices. There is a Backdoor root account. |
CVE-2020-10988 | Critical | 9.8 | 2020-07-13 | A hard-coded telnet credential in the tenda_login binary of Tenda AC15 AC1900 version 15.03.05.19 allows unauthenticated remote attackers to start a telnetd se… |
CVE-2020-2500 | Critical | 9.8 | 2020-07-01 | This improper access control vulnerability in Helpdesk allows attackers to get control of QNAP Kayako service. Attackers can access the sensitive data on QNAP… |
CVE-2020-14474 | High | 7.5 | 2020-06-30 | The Cellebrite UFED physical device 5.0 through 7.5.0.845 relies on key material hardcoded within both the executable code supporting the decryption process, a… |
CVE-2018-6446 | Critical | 9.8 | 2020-06-29 | A vulnerability in Brocade Network Advisor Version Before 14.3.1 could allow an unauthenticated, remote attacker to log in to the JBoss Administration interfac… |
CVE-2020-15324 | Critical | 9.8 | 2020-06-29 | Zyxel CloudCNM SecuManager 3.1.0 and 3.1.1 has a world-readable axess/opt/axXMPPHandler/config/xmpp_config.py file that stores hardcoded credentials. |
CVE-2020-15323 | Critical | 9.8 | 2020-06-29 | Zyxel CloudCNM SecuManager 3.1.0 and 3.1.1 has the cloud1234 password for the a1@chopin account default credentials. |
CVE-2020-15322 | Critical | 9.8 | 2020-06-29 | Zyxel CloudCNM SecuManager 3.1.0 and 3.1.1 has the wbboEZ4BN3ssxAfM hardcoded password for the debian-sys-maint account. |
CVE-2020-15321 | Critical | 9.8 | 2020-06-29 | Zyxel CloudCNM SecuManager 3.1.0 and 3.1.1 has the axzyxel password for the livedbuser account. |
CVE-2020-15320 | Critical | 9.8 | 2020-06-29 | Zyxel CloudCNM SecuManager 3.1.0 and 3.1.1 has the axiros password for the root account. |
CVE-2020-15319 | Medium | 5.9 | 2020-06-29 | Zyxel CloudCNM SecuManager 3.1.0 and 3.1.1 has a hardcoded RSA SSH key for the root account within the /opt/mysql chroot directory tree. |
CVE-2020-15318 | Medium | 5.9 | 2020-06-29 | Zyxel CloudCNM SecuManager 3.1.0 and 3.1.1 has a hardcoded DSA SSH key for the root account within the /opt/mysql chroot directory tree. |
CVE-2020-15317 | Medium | 5.9 | 2020-06-29 | Zyxel CloudCNM SecuManager 3.1.0 and 3.1.1 has a hardcoded RSA SSH key for the root account within the /opt/axess chroot directory tree. |
CVE-2020-15316 | Medium | 5.9 | 2020-06-29 | Zyxel CloudCNM SecuManager 3.1.0 and 3.1.1 has a hardcoded ECDSA SSH key for the root account within the /opt/axess chroot directory tree. |
CVE-2020-15315 | Medium | 5.9 | 2020-06-29 | Zyxel CloudCNM SecuManager 3.1.0 and 3.1.1 has a hardcoded DSA SSH key for the root account within the /opt/axess chroot directory tree. |
CVE-2020-15314 | Medium | 5.9 | 2020-06-29 | Zyxel CloudCNM SecuManager 3.1.0 and 3.1.1 has a hardcoded RSA SSH key for the root account. |
CVE-2020-15313 | Medium | 5.9 | 2020-06-29 | Zyxel CloudCNM SecuManager 3.1.0 and 3.1.1 has a hardcoded ECDSA SSH key for the root account. |
CVE-2020-15312 | Medium | 5.9 | 2020-06-29 | Zyxel CloudCNM SecuManager 3.1.0 and 3.1.1 has a hardcoded DSA SSH key for the root account. |
CVE-2020-8573 | Medium | 6.5 | 2020-06-29 | The NetApp HCI H610C, H615C and H610S Baseboard Management Controllers (BMC) are shipped with a documented default account and password that should be changed… |
CVE-2020-12047 | Critical | 9.8 | 2020-06-29 | The Baxter Spectrum WBM (v17, v20D29, v20D30, v20D31, and v22D24), when used with a Baxter Spectrum v8.x (model 35700BAX2) in a factory-default wireless config… |
CVE-2020-12045 | Critical | 9.8 | 2020-06-29 | The Baxter Spectrum WBM (v17, v20D29, v20D30, v20D31, and v22D24) when used in conjunction with a Baxter Spectrum v8.x (model 35700BAX2), operates a Telnet ser… |
CVE-2020-12039 | Low | 2.4 | 2020-06-29 | Baxter Sigma Spectrum Infusion Pumps Sigma Spectrum Infusion System v's6.x model 35700BAX & Baxter Spectrum Infusion System v's8.x model 35700BAX2 contain hard… |
CVE-2020-12035 | Medium | 4.9 | 2020-06-29 | Baxter PrismaFlex all versions, PrisMax all versions prior to 3.x, The PrismaFlex device contains a hard-coded service password that provides access to biomedi… |
CVE-2020-12016 | Critical | 9.8 | 2020-06-29 | Baxter ExactaMix EM 2400 & EM 1200, Versions ExactaMix EM2400 Versions 1.10, 1.11, 1.13, 1.14, ExactaMix EM1200 Versions 1.1, 1.2, 1.4, 1.5, Baxter ExactaMix E… |
CVE-2020-12012 | Medium | 6.1 | 2020-06-29 | Baxter ExactaMix EM 2400 & EM 1200, Versions ExactaMix EM2400 Versions 1.10, 1.11, 1.13, 1.14, ExactaMix EM1200 Versions 1.1, 1.2, 1.4, 1.5, Baxter ExactaMix E… |
CVE-2020-10276 | Critical | 9.8 | 2020-06-24 | The password for the safety PLC is the default and thus easy to find (in manuals, etc.). This allows a manipulated program to be uploaded to the safety PLC, ef… |
CVE-2020-10270 | Critical | 9.8 | 2020-06-24 | Out of the wired and wireless interfaces within MiR100, MiR200 and other vehicles from the MiR fleet, it's possible to access the Control Dashboard on a hardco… |
CVE-2020-10269 | Critical | 9.8 | 2020-06-24 | One of the wireless interfaces within MiR100, MiR200 and possibly (according to the vendor) other MiR fleet vehicles comes pre-configured in WiFi Master (Acces… |
CVE-2020-9289 | High | 7.5 | 2020-06-16 | Use of a hard-coded cryptographic key to encrypt password data in CLI configuration in FortiManager 6.2.3 and below, FortiAnalyzer 6.2.3 and below may allow an… |
CVE-2020-7501 | High | 8.8 | 2020-06-16 | A CWE-798: Use of Hard-coded Credentials vulnerability exists in Vijeo Designer Basic (V1.1 HotFix 16 and prior) and Vijeo Designer (V6.2 SP9 and prior) which… |
CVE-2020-7498 | Critical | 9.8 | 2020-06-16 | A CWE-798: Use of Hard-coded Credentials vulnerability exists in the Unity Loader and OS Loader Software (all versions). The fixed credentials are used to simp… |
CVE-2020-4216 | Critical | 9.8 | 2020-06-15 | IBM Spectrum Protect Plus 10.1.0 through 10.1.5 contains hard-coded credentials, such as a password or cryptographic key, which it uses for its own inbound aut… |
CVE-2020-3928 | Medium | 6.2 | 2020-06-12 | GeoVision Door Access Control device family is hardcoded with a root password, which adopting an identical password in all devices. |
CVE-2020-6265 | Critical | 9.8 | 2020-06-09 | SAP Commerce, versions - 6.7, 1808, 1811, 1905, and SAP Commerce (Data Hub), versions - 6.7, 1808, 1811, 1905, allows an attacker to bypass the authentication… |
CVE-2020-13804 | Critical | 9.8 | 2020-06-04 | An issue was discovered in Foxit Reader and PhantomPDF before 9.7.2. It allows information disclosure of a hardcoded username and password in the DocuSign plug… |
CVE-2019-16150 | Medium | 5.5 | 2020-06-04 | Use of a hard-coded cryptographic key to encrypt security sensitive data in local storage and configuration in FortiClient for Windows prior to 6.4.0 may allow… |
CVE-2020-3234 | High | 8.8 | 2020-06-03 | A vulnerability in the virtual console authentication of Cisco IOS Software for Cisco 809 and 829 Industrial Integrated Services Routers (Industrial ISRs) and… |
CVE-2020-4190 | Medium | 6.7 | 2020-06-03 | IBM Security Guardium 10.6, 11.0, and 11.1 contains hard-coded credentials, such as a password or cryptographic key, which it uses for its own inbound authenti… |
CVE-2020-4177 | Critical | 9.8 | 2020-06-03 | IBM Security Guardium 11.1 contains hard-coded credentials, such as a password or cryptographic key, which it uses for its own inbound authentication, outbound… |
CVE-2020-13414 | High | 7.5 | 2020-05-22 | An issue was discovered in Aviatrix Controller before 5.4.1204. It contains credentials unused by the software. |
CVE-2020-13166 | Critical | 9.8 | 2020-05-19 | The management tool in MyLittleAdmin 3.8 allows remote attackers to execute arbitrary code because machineKey is hardcoded (the same for all customers' install… |
CVE-2020-11549 | High | 8.8 | 2020-05-18 | An issue was discovered on NETGEAR Orbi Tri-Band Business WiFi Add-on Satellite (SRS60) AC3000 V2.5.1.106, Outdoor Satellite (RBS50Y) V2.5.1.106, and Pro Tri-B… |
CVE-2020-5248 | High | 7.2 | 2020-05-12 | GLPI before before version 9.4.6 has a vulnerability involving a default encryption key. GLPIKEY is public and is used on every instance. This means anyone can… |
CVE-2020-4429 | Critical | 9.8 | 2020-05-07 | IBM Data Risk Manager 2.0.1, 2.0.2, 2.0.3, 2.0.4, 2.0.5, and 2.0.6 contains a default password for an IDRM administrative account. A remote attacker could expl… |
CVE-2020-3318 | Critical | 9.8 | 2020-05-06 | Multiple vulnerabilities in Cisco Firepower Management Center (FMC) Software and Cisco Firepower User Agent Software could allow an attacker to access a sensit… |
CVE-2020-3301 | Medium | 4.4 | 2020-05-06 | Multiple vulnerabilities in Cisco Firepower Management Center (FMC) Software and Cisco Firepower User Agent Software could allow an attacker to access a sensit… |
CVE-2020-12110 | Critical | 9.8 | 2020-05-04 | Certain TP-Link devices have a Hardcoded Encryption Key. This affects NC200 2.1.9 build 200225, N210 1.0.9 build 200304, NC220 1.3.0 build 200304, NC230 1.3.0… |
CVE-2020-12627 | Critical | 9.8 | 2020-05-04 | Calibre-Web 0.6.6 allows authentication bypass because of the 'A0Zr98j/3yX R~XHH!jmN]LWX/,?RT' hardcoded secret key. |
CVE-2019-5622 | Critical | 9.8 | 2020-04-29 | Accellion File Transfer Appliance version FTA_8_0_540 suffers from an instance of CWE-798: Use of Hard-coded Credentials. |
CVE-2020-10996 | High | 8.1 | 2020-04-27 | An issue was discovered in Percona XtraDB Cluster before 5.7.28-31.41.2. A bundled script inadvertently sets a static transition_key for SST processes in place… |
CVE-2018-21137 | Critical | 9.8 | 2020-04-23 | Certain NETGEAR devices are affected by a hardcoded password. This affects D3600 before 1.0.0.76 and D6000 before 1.0.0.76. |
CVE-2019-6859 | High | 7.5 | 2020-04-22 | A CWE-798: Use of Hardcoded Credentials vulnerability exists in Modicon Controllers (All versions of the following CPUs and Communication Module product refere… |
CVE-2019-4327 | High | 7.5 | 2020-04-21 | "HCL AppScan Enterprise uses hard-coded credentials which can be exploited by attackers to get unauthorized access to application's encrypted files." |
CVE-2020-9279 | Critical | 9.8 | 2020-04-20 | An issue was discovered on D-Link DSL-2640B B2 EU_4.01B devices. A hard-coded account allows management-interface login with high privileges. The logged-in use… |
CVE-2019-19108 | Critical | 9.4 | 2020-04-20 | An authentication weakness in the SNMP service in B&R Automation Runtime versions 2.96, 3.00, 3.01, 3.06 to 3.10, 4.00 to 4.63, 4.72 and above allows unauthent… |
CVE-2020-11878 | Critical | 9.8 | 2020-04-17 | The Jitsi Meet (aka docker-jitsi-meet) stack on Docker before stable-4384-1 uses default passwords (such as passw0rd) for system accounts. |
CVE-2019-20656 | High | 8.8 | 2020-04-15 | Certain NETGEAR devices are affected by a hardcoded password. This affects D6200 before 1.1.00.36, D7000 before 1.0.1.74, PR2000 before 1.0.0.30, R6020 before… |
CVE-2020-4269 | High | 7.5 | 2020-04-15 | IBM QRadar 7.3.0 to 7.3.3 Patch 2 contains hard-coded credentials, such as a password or cryptographic key, which it uses for its own inbound authentication, o… |
CVE-2020-11723 | Medium | 5.5 | 2020-04-14 | Cellebrite UFED 5.0 through 7.29 uses four hardcoded RSA private keys to authenticate to the ADB daemon on target devices. Extracted keys can be used to place… |
CVE-2020-1615 | Critical | 9.8 | 2020-04-08 | The factory configuration for vMX installations, as shipped, includes default credentials for the root account. Without proper modification of these default cr… |
CVE-2020-1614 | Critical | 10.0 | 2020-04-08 | A Use of Hard-coded Credentials vulnerability exists in the NFX250 Series for the vSRX Virtual Network Function (VNF) instance, which allows an attacker to tak… |
CVE-2020-11543 | Critical | 9.8 | 2020-04-08 | OpsRamp Gateway before 7.0.0 has a backdoor account vadmin with the password 9vt@f3Vt that allows root SSH access to the server. This issue has been resolved i… |