CWE-798 · Use of Hard-coded Credentials (page 14)
Page 14 of 18 — CVEs classified under CWE-798, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2020-4177 | Critical | 9.8 | 2020-06-03 | IBM Security Guardium 11.1 contains hard-coded credentials, such as a password or cryptographic key, which it uses for its own inbound authentication, outbound… |
CVE-2020-13414 | High | 7.5 | 2020-05-22 | An issue was discovered in Aviatrix Controller before 5.4.1204. It contains credentials unused by the software. |
CVE-2020-13166 | Critical | 9.8 | 2020-05-19 | The management tool in MyLittleAdmin 3.8 allows remote attackers to execute arbitrary code because machineKey is hardcoded (the same for all customers' install… |
CVE-2020-11549 | High | 8.8 | 2020-05-18 | An issue was discovered on NETGEAR Orbi Tri-Band Business WiFi Add-on Satellite (SRS60) AC3000 V2.5.1.106, Outdoor Satellite (RBS50Y) V2.5.1.106, and Pro Tri-B… |
CVE-2020-5248 | High | 7.2 | 2020-05-12 | GLPI before before version 9.4.6 has a vulnerability involving a default encryption key. GLPIKEY is public and is used on every instance. This means anyone can… |
CVE-2020-4429 | Critical | 9.8 | 2020-05-07 | IBM Data Risk Manager 2.0.1, 2.0.2, 2.0.3, 2.0.4, 2.0.5, and 2.0.6 contains a default password for an IDRM administrative account. A remote attacker could expl… |
CVE-2020-3318 | Critical | 9.8 | 2020-05-06 | Multiple vulnerabilities in Cisco Firepower Management Center (FMC) Software and Cisco Firepower User Agent Software could allow an attacker to access a sensit… |
CVE-2020-3301 | Medium | 4.4 | 2020-05-06 | Multiple vulnerabilities in Cisco Firepower Management Center (FMC) Software and Cisco Firepower User Agent Software could allow an attacker to access a sensit… |
CVE-2020-12110 | Critical | 9.8 | 2020-05-04 | Certain TP-Link devices have a Hardcoded Encryption Key. This affects NC200 2.1.9 build 200225, N210 1.0.9 build 200304, NC220 1.3.0 build 200304, NC230 1.3.0… |
CVE-2020-12627 | Critical | 9.8 | 2020-05-04 | Calibre-Web 0.6.6 allows authentication bypass because of the 'A0Zr98j/3yX R~XHH!jmN]LWX/,?RT' hardcoded secret key. |
CVE-2019-5622 | Critical | 9.8 | 2020-04-29 | Accellion File Transfer Appliance version FTA_8_0_540 suffers from an instance of CWE-798: Use of Hard-coded Credentials. |
CVE-2020-10996 | High | 8.1 | 2020-04-27 | An issue was discovered in Percona XtraDB Cluster before 5.7.28-31.41.2. A bundled script inadvertently sets a static transition_key for SST processes in place… |
CVE-2018-21137 | Critical | 9.8 | 2020-04-23 | Certain NETGEAR devices are affected by a hardcoded password. This affects D3600 before 1.0.0.76 and D6000 before 1.0.0.76. |
CVE-2019-6859 | High | 7.5 | 2020-04-22 | A CWE-798: Use of Hardcoded Credentials vulnerability exists in Modicon Controllers (All versions of the following CPUs and Communication Module product refere… |
CVE-2019-4327 | High | 7.5 | 2020-04-21 | "HCL AppScan Enterprise uses hard-coded credentials which can be exploited by attackers to get unauthorized access to application's encrypted files." |
CVE-2020-9279 | Critical | 9.8 | 2020-04-20 | An issue was discovered on D-Link DSL-2640B B2 EU_4.01B devices. A hard-coded account allows management-interface login with high privileges. The logged-in use… |
CVE-2019-19108 | Critical | 9.4 | 2020-04-20 | An authentication weakness in the SNMP service in B&R Automation Runtime versions 2.96, 3.00, 3.01, 3.06 to 3.10, 4.00 to 4.63, 4.72 and above allows unauthent… |
CVE-2020-11878 | Critical | 9.8 | 2020-04-17 | The Jitsi Meet (aka docker-jitsi-meet) stack on Docker before stable-4384-1 uses default passwords (such as passw0rd) for system accounts. |
CVE-2019-20656 | High | 8.8 | 2020-04-15 | Certain NETGEAR devices are affected by a hardcoded password. This affects D6200 before 1.1.00.36, D7000 before 1.0.1.74, PR2000 before 1.0.0.30, R6020 before… |
CVE-2020-4269 | High | 7.5 | 2020-04-15 | IBM QRadar 7.3.0 to 7.3.3 Patch 2 contains hard-coded credentials, such as a password or cryptographic key, which it uses for its own inbound authentication, o… |
CVE-2020-11723 | Medium | 5.5 | 2020-04-14 | Cellebrite UFED 5.0 through 7.29 uses four hardcoded RSA private keys to authenticate to the ADB daemon on target devices. Extracted keys can be used to place… |
CVE-2020-1615 | Critical | 9.8 | 2020-04-08 | The factory configuration for vMX installations, as shipped, includes default credentials for the root account. Without proper modification of these default cr… |
CVE-2020-1614 | Critical | 10.0 | 2020-04-08 | A Use of Hard-coded Credentials vulnerability exists in the NFX250 Series for the vSRX Virtual Network Function (VNF) instance, which allows an attacker to tak… |
CVE-2020-11543 | Critical | 9.8 | 2020-04-08 | OpsRamp Gateway before 7.0.0 has a backdoor account vadmin with the password 9vt@f3Vt that allows root SSH access to the server. This issue has been resolved i… |
CVE-2019-13559 | High | 7.8 | 2020-04-07 | GE Mark VIe Controller is shipped with pre-configured hard-coded credentials that may allow root-user access to the controller. A limited application of the af… |
CVE-2020-4208 | Critical | 9.8 | 2020-03-31 | IBM Spectrum Protect Plus 10.1.0 through 10.1.5 contains hard-coded credentials, such as a password or cryptographic key, which it uses for its own inbound aut… |
CVE-2020-1764 | High | 8.6 | 2020-03-26 | A hard-coded cryptographic key vulnerability in the default configuration file was found in Kiali, all versions prior to 1.15.1. A remote attacker could abuse… |
CVE-2020-10884 | High | 8.8 | 2020-03-25 | This vulnerability allows network-adjacent attackers execute arbitrary code on affected installations of TP-Link Archer A7 Firmware Ver: 190726 AC1750 routers… |
CVE-2020-10788 | Critical | 9.1 | 2020-03-25 | openITCOCKPIT before 3.7.3 uses the 1fea123e07f730f76e661bced33a94152378611e API key rather than generating a random API Key for WebSocket connections. |
CVE-2020-6981 | Critical | 9.8 | 2020-03-24 | In Moxa EDS-G516E Series firmware, Version 5.2 or lower, an attacker may gain access to the system without proper authentication. |
CVE-2020-6979 | High | 7.5 | 2020-03-24 | In Moxa EDS-G516E Series firmware, Version 5.2 or lower, the affected products use a hard-coded cryptographic key, increasing the possibility that confidential… |
CVE-2020-6985 | Critical | 9.8 | 2020-03-24 | In Moxa PT-7528 series firmware, Version 4.0 or lower, and PT-7828 series firmware, Version 3.9 or lower, these devices use a hard-coded service code for acces… |
CVE-2020-6983 | High | 7.5 | 2020-03-24 | In Moxa PT-7528 series firmware, Version 4.0 or lower, and PT-7828 series firmware, Version 3.9 or lower, the affected products use a hard-coded cryptographic… |
CVE-2020-8868 | Critical | 9.8 | 2020-03-23 | This vulnerability allows remote attackers to execute arbitrary code on affected installations of Quest Foglight Evolve 9.0.0. Authentication is not required t… |
CVE-2019-15075 | High | 7.5 | 2020-03-20 | An issue was discovered in iNextrix ASTPP before 4.0.1. web_interface/astpp/application/config/config.php does not have strong random keys, as demonstrated by… |
CVE-2020-6990 | Critical | 9.8 | 2020-03-16 | Rockwell Automation MicroLogix 1400 Controllers Series B v21.001 and prior, Series A, all versions, MicroLogix 1100 Controller, all versions, RSLogix 500 Softw… |
CVE-2019-14309 | High | 7.5 | 2020-03-13 | Ricoh SP C250DN 1.05 devices have a fixed password. FTP service credential were found to be hardcoded within the printer firmware. This would allow to an attac… |
CVE-2020-9435 | High | 7.5 | 2020-03-12 | PHOENIX CONTACT TC ROUTER 3002T-4G through 2.05.3, TC ROUTER 2002T-3G through 2.05.3, TC ROUTER 3002T-4G VZW through 2.05.3, TC ROUTER 3002T-4G ATT through 2.0… |
CVE-2019-5158 | High | 7.8 | 2020-03-11 | An exploitable firmware downgrade vulnerability exists in the firmware update package functionality of the WAGO e!COCKPIT automation software v1.6.1.5. A speci… |
CVE-2019-5106 | Medium | 5.5 | 2020-03-11 | A hard-coded encryption key vulnerability exists in the authentication functionality of WAGO e!Cockpit version 1.5.1.1. An attacker with access to communicatio… |
CVE-2020-4283 | High | 8.6 | 2020-03-02 | IBM Security Information Queue (ISIQ) 1.0.0, 1.0.1, 1.0.2, 1.0.3, and 1.0.4 contains hard-coded credentials, such as a password or cryptographic key, which it… |
CVE-2020-3165 | High | 8.2 | 2020-02-26 | A vulnerability in the implementation of Border Gateway Protocol (BGP) Message Digest 5 (MD5) authentication in Cisco NX-OS Software could allow an unauthentic… |
CVE-2019-5139 | High | 7.1 | 2020-02-25 | An exploitable use of hard-coded credentials vulnerability exists in multiple iw_* utilities of the Moxa AWK-3131A firmware version 1.13. The device operating… |
CVE-2019-5137 | High | 7.5 | 2020-02-25 | The usage of hard-coded cryptographic keys within the ServiceAgent binary allows for the decryption of captured traffic across the network from or to the Moxa… |
CVE-2020-3158 | Critical | 9.1 | 2020-02-19 | A vulnerability in the High Availability (HA) service of Cisco Smart Software Manager On-Prem could allow an unauthenticated, remote attacker to access a sensi… |
CVE-2014-9614 | Critical | 9.8 | 2020-02-19 | The Web Panel in Netsweeper before 4.0.5 has a default password of branding for the branding account, which makes it easier for remote attackers to obtain acce… |
CVE-2019-4392 | Critical | 9.8 | 2020-02-14 | HCL AppScan Standard Edition 9.0.3.13 and earlier uses hard-coded credentials which can be exploited by attackers to get unauthorized access to the system. |
CVE-2013-6362 | Critical | 9.8 | 2020-02-13 | Xerox ColorCube and WorkCenter devices in 2013 had hardcoded FTP and shell user accounts. |
CVE-2013-6277 | High | 7.5 | 2020-02-13 | QNAP VioCard 300 has hardcoded RSA private keys. |
CVE-2020-8964 | Critical | 9.8 | 2020-02-13 | TimeTools SC7105 1.0.007, SC9205 1.0.007, SC9705 1.0.007, SR7110 1.0.007, SR9210 1.0.007, SR9750 1.0.007, SR9850 1.0.007, T100 1.0.003, T300 1.0.003, and T550… |
CVE-2013-6236 | Critical | 9.8 | 2020-02-12 | IZON IP 2.0.2: hard-coded password vulnerability |
CVE-2012-6611 | Critical | 9.8 | 2020-02-10 | An issue was discovered in Polycom Web Management Interface G3/HDX 8000 HD with Durango 2.6.0 4740 software and embedded Polycom Linux Development Platform 2.1… |
CVE-2012-4381 | High | 8.1 | 2020-02-08 | MediaWiki before 1.18.5, and 1.19.x before 1.19.2 saves passwords in the local database, (1) which could make it easier for context-dependent attackers to obta… |
CVE-2020-8657 | Critical | 9.8 | 2020-02-06 | An issue was discovered in EyesOfNetwork 5.3. The installation uses the same API key (hardcoded as EONAPI_KEY in include/api_functions.php for API version 2.4… |
CVE-2019-4675 | Critical | 9.8 | 2020-02-04 | IBM Security Identity Manager 7.0.1 contains hard-coded credentials, such as a password or cryptographic key, which it uses for its own inbound authentication… |
CVE-2012-5686 | Critical | 9.8 | 2020-02-04 | ZPanel 10.0.1 has insufficient entropy for its password reset process. |
CVE-2020-5222 | Medium | 6.8 | 2020-01-30 | Opencast before 7.6 and 8.1 enables a remember-me cookie based on a hash created from the username, password, and an additional system key. This means that an… |
CVE-2013-1352 | High | 7.5 | 2020-01-30 | Verax NMS prior to 2.1.0 uses an encryption key that is hardcoded in a JAR archive. |
CVE-2013-2572 | High | 7.5 | 2020-01-29 | A Security Bypass vulnerability exists in TP-LINK IP Cameras TL-SC 3130, TL-SC 3130G, 3171G, 4171G, and 3130 1.6.18P12 due to default hard-coded credentials fo… |
CVE-2013-2567 | High | 7.5 | 2020-01-29 | An Authentication Bypass vulnerability exists in the web interface in Zavio IP Cameras through 1.6.03 due to a hardcoded admin account found in boa.conf, which… |
CVE-2013-1603 | Medium | 5.3 | 2020-01-28 | An Authentication vulnerability exists in D-LINK WCS-1100 1.02, TESCO DCS-2121 1.05_TESCO, TESCO DCS-2102 1.05_TESCO, DCS-7510 1.00, DCS-7410 1.00, DCS-6410 1… |
CVE-2020-8001 | Critical | 9.8 | 2020-01-27 | The Intellian Aptus application 1.0.2 for Android has a hardcoded password of intellian for the masteruser FTP account. |
CVE-2020-8000 | Critical | 9.8 | 2020-01-27 | Intellian Aptus Web 1.24 has a hardcoded password of 12345678 for the intellian account. |
CVE-2020-7999 | Critical | 9.8 | 2020-01-27 | The Intellian Aptus application 1.0.2 for Android has hardcoded values for DOWNLOAD_API_KEY and FILE_DOWNLOAD_API_KEY. |
CVE-2020-6963 | Critical | 10.0 | 2020-01-24 | In ApexPro Telemetry Server Versions 4.2 and prior, CARESCAPE Telemetry Server v4.2 & prior, Clinical Information Center (CIC) Versions 4.X and 5.X, CARESCAPE… |
CVE-2019-16153 | Critical | 9.8 | 2020-01-23 | A hard-coded password vulnerability in the Fortinet FortiSIEM database component version 5.2.5 and below may allow attackers to access the device database via… |
CVE-2020-6857 | Medium | 5.5 | 2020-01-21 | CarbonFTP v1.4 uses insecure proprietary password encryption with a hard-coded weak encryption key. The key for local FTP server passwords is hard-coded in the… |
CVE-2019-9493 | Medium | 6.5 | 2020-01-15 | The MyCar Controls of AutoMobility Distribution Inc., mobile application contains hard-coded admin credentials. A remote unauthenticated attacker may be able t… |
CVE-2019-10995 | High | 8.8 | 2020-01-14 | ABB CP651 HMI products revision BSP UN30 v1.76 and prior implement hidden administrative accounts that are used during the provisioning phase of the HMI interf… |
CVE-2019-14919 | High | 7.8 | 2020-01-09 | An exposed Telnet Service on the Billion Smart Energy Router SG600R2 with firmware v3.02.rc6 allows a local network attacker to authenticate via hardcoded cred… |
CVE-2019-14837 | Critical | 9.1 | 2020-01-07 | A flaw was found in keycloack before version 8.0.0. The owner of 'placeholder.org' domain can setup mail server on this domain and knowing only name of a clien… |
CVE-2019-15977 | High | 7.5 | 2020-01-06 | Multiple vulnerabilities in the authentication mechanisms of Cisco Data Center Network Manager (DCNM) could allow an unauthenticated, remote attacker to bypass… |
CVE-2019-15976 | Critical | 9.8 | 2020-01-06 | Multiple vulnerabilities in the authentication mechanisms of Cisco Data Center Network Manager (DCNM) could allow an unauthenticated, remote attacker to bypass… |
CVE-2019-15975 | Critical | 9.8 | 2020-01-06 | Multiple vulnerabilities in the authentication mechanisms of Cisco Data Center Network Manager (DCNM) could allow an unauthenticated, remote attacker to bypass… |
CVE-2013-3619 | High | 8.1 | 2020-01-02 | Intelligent Platform Management Interface (IPMI) with firmware for Supermicro X9 generation motherboards before SMT_X9_317 and firmware for Supermicro X8 gener… |
CVE-2019-18831 | Medium | 5.3 | 2019-12-16 | Barco ClickShare Button R9861500D01 devices before 1.9.0 allow Information Exposure. The encrypted ClickShare Button firmware contains the private key of a tes… |
CVE-2019-16734 | Critical | 9.8 | 2019-12-13 | Use of default credentials for the TELNET server in Petwant PF-103 firmware 4.3.2.50 and Petalk AI 3.2.2.30 allows remote attackers to execute arbitrary system… |
CVE-2014-0175 | Critical | 9.8 | 2019-12-13 | mcollective has a default password set at install |
CVE-2019-10694 | Critical | 9.8 | 2019-12-12 | The express install, which is the suggested way to install Puppet Enterprise, gives the user a URL at the end of the install to set the admin password. If they… |
CVE-2019-3983 | Medium | 6.8 | 2019-12-11 | Blink XT2 Sync Module firmware prior to 2.13.11 allows remote attackers to execute arbitrary code and commands on the device due to insufficient UART protectio… |
CVE-2013-3542 | Critical | 10.0 | 2019-12-11 | Grandstream GXV3501, GXV3504, GXV3601, GXV3601HD/LL, GXV3611HD/LL, GXV3615W/P, GXV3651FHD, GXV3662HD, GXV3615WP_HD, GXV3500, and possibly other camera models w… |
CVE-2019-19021 | Critical | 9.8 | 2019-12-02 | An issue was discovered in TitanHQ WebTitan before 5.18. It has a hidden support account (with a hard-coded password) in the web administration interface, with… |
CVE-2019-19017 | High | 8.1 | 2019-12-02 | An issue was discovered in TitanHQ WebTitan before 5.18. The appliance has a hard-coded root password set during installation. An attacker could utilize this t… |
CVE-2019-19492 | Critical | 9.8 | 2019-12-02 | FreeSWITCH 1.6.10 through 1.10.1 has a default password in event_socket.conf.xml. |
CVE-2019-19033 | Critical | 9.8 | 2019-11-21 | Jalios JCMS 10 allows attackers to access any part of the website and the WebDAV server with administrative privileges via a backdoor account, by using any use… |
CVE-2019-6693 | Medium | 6.5 | 2019-11-21 | Use of a hard-coded cryptographic key to cipher sensitive data in FortiOS configuration backup file may allow an attacker with access to the backup file to dec… |
CVE-2018-9195 | Medium | 5.9 | 2019-11-21 | Use of a hardcoded cryptographic key in the FortiGuard services communication protocol may allow a Man in the middle with knowledge of the key to eavesdrop on… |
CVE-2019-15802 | Medium | 5.9 | 2019-11-14 | An issue was discovered on Zyxel GS1900 devices with firmware before 2.50(AAHH.0)C0. The firmware hashes and encrypts passwords using a hardcoded cryptographic… |
CVE-2019-15801 | High | 7.5 | 2019-11-14 | An issue was discovered on Zyxel GS1900 devices with firmware before 2.50(AAHH.0)C0. The firmware image contains encrypted passwords that are used to authentic… |
CVE-2019-13543 | Medium | 5.8 | 2019-11-08 | Medtronic Valleylab Exchange Client version 3.4 and below, Valleylab FT10 Energy Platform (VLFT10GEN) software version 4.0.0 and below, and Valleylab FX8 Energ… |
CVE-2019-16207 | High | 7.8 | 2019-11-08 | Brocade SANnav versions before v2.0 use a hard-coded password, which could allow local authenticated attackers to access a back-end database and gain privilege… |
CVE-2015-7276 | Medium | 5.9 | 2019-11-06 | Technicolor C2000T and C2100T uses hard-coded cryptographic keys. |
CVE-2018-18929 | High | 8.8 | 2019-10-29 | The Tightrope Media Carousel Seneca HDn Windows-based appliance 7.0.4.104 is shipped with a default local administrator username and password. This can be foun… |
CVE-2019-4309 | Medium | 5.5 | 2019-10-29 | IBM Security Guardium Big Data Intelligence (SonarG) 4.0 uses hard coded credentials which could allow a local user to obtain highly sensitive information. IBM… |
CVE-2019-14930 | Critical | 9.8 | 2019-10-28 | An issue was discovered on Mitsubishi Electric Europe B.V. ME-RTU devices through 2.02 and INEA ME-RTU devices through 3.0. Undocumented hard-coded user passwo… |
CVE-2019-14926 | Critical | 9.8 | 2019-10-28 | An issue was discovered on Mitsubishi Electric Europe B.V. ME-RTU devices through 2.02 and INEA ME-RTU devices through 3.0. Hard-coded SSH keys allow an attack… |
CVE-2019-13553 | Critical | 9.8 | 2019-10-25 | Rittal Chiller SK 3232-Series web interface as built upon Carel pCOWeb firmware A1.5.3 – B1.2.4. The authentication mechanism on affected systems is configured… |
CVE-2016-2360 | Critical | 9.8 | 2019-10-25 | Milesight IP security cameras through 2016-11-14 have a default root password in /etc/shadow that is the same across different customers' installations. |
CVE-2016-2358 | Critical | 9.8 | 2019-10-25 | Milesight IP security cameras through 2016-11-14 have a default set of 10 privileged accounts with hardcoded credentials. They are accessible if the customer h… |
CVE-2016-2357 | Critical | 9.8 | 2019-10-25 | Milesight IP security cameras through 2016-11-14 have a hardcoded SSL private key under the /etc/config directory. |