CWE-798 · Use of Hard-coded Credentials (page 15)
Page 15 of 19 — CVEs classified under CWE-798, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2019-13559 | High | 7.8 | 2020-04-07 | GE Mark VIe Controller is shipped with pre-configured hard-coded credentials that may allow root-user access to the controller. A limited application of the af… |
CVE-2020-4208 | Critical | 9.8 | 2020-03-31 | IBM Spectrum Protect Plus 10.1.0 through 10.1.5 contains hard-coded credentials, such as a password or cryptographic key, which it uses for its own inbound aut… |
CVE-2020-1764 | High | 8.6 | 2020-03-26 | A hard-coded cryptographic key vulnerability in the default configuration file was found in Kiali, all versions prior to 1.15.1. A remote attacker could abuse… |
CVE-2020-10884 | High | 8.8 | 2020-03-25 | This vulnerability allows network-adjacent attackers execute arbitrary code on affected installations of TP-Link Archer A7 Firmware Ver: 190726 AC1750 routers… |
CVE-2020-10788 | Critical | 9.1 | 2020-03-25 | openITCOCKPIT before 3.7.3 uses the 1fea123e07f730f76e661bced33a94152378611e API key rather than generating a random API Key for WebSocket connections. |
CVE-2020-6981 | Critical | 9.8 | 2020-03-24 | In Moxa EDS-G516E Series firmware, Version 5.2 or lower, an attacker may gain access to the system without proper authentication. |
CVE-2020-6979 | High | 7.5 | 2020-03-24 | In Moxa EDS-G516E Series firmware, Version 5.2 or lower, the affected products use a hard-coded cryptographic key, increasing the possibility that confidential… |
CVE-2020-6985 | Critical | 9.8 | 2020-03-24 | In Moxa PT-7528 series firmware, Version 4.0 or lower, and PT-7828 series firmware, Version 3.9 or lower, these devices use a hard-coded service code for acces… |
CVE-2020-6983 | High | 7.5 | 2020-03-24 | In Moxa PT-7528 series firmware, Version 4.0 or lower, and PT-7828 series firmware, Version 3.9 or lower, the affected products use a hard-coded cryptographic… |
CVE-2020-8868 | Critical | 9.8 | 2020-03-23 | This vulnerability allows remote attackers to execute arbitrary code on affected installations of Quest Foglight Evolve 9.0.0. Authentication is not required t… |
CVE-2019-15075 | High | 7.5 | 2020-03-20 | An issue was discovered in iNextrix ASTPP before 4.0.1. web_interface/astpp/application/config/config.php does not have strong random keys, as demonstrated by… |
CVE-2020-6990 | Critical | 9.8 | 2020-03-16 | Rockwell Automation MicroLogix 1400 Controllers Series B v21.001 and prior, Series A, all versions, MicroLogix 1100 Controller, all versions, RSLogix 500 Softw… |
CVE-2019-14309 | High | 7.5 | 2020-03-13 | Ricoh SP C250DN 1.05 devices have a fixed password. FTP service credential were found to be hardcoded within the printer firmware. This would allow to an attac… |
CVE-2020-9435 | High | 7.5 | 2020-03-12 | PHOENIX CONTACT TC ROUTER 3002T-4G through 2.05.3, TC ROUTER 2002T-3G through 2.05.3, TC ROUTER 3002T-4G VZW through 2.05.3, TC ROUTER 3002T-4G ATT through 2.0… |
CVE-2019-5158 | High | 7.8 | 2020-03-11 | An exploitable firmware downgrade vulnerability exists in the firmware update package functionality of the WAGO e!COCKPIT automation software v1.6.1.5. A speci… |
CVE-2019-5106 | Medium | 5.5 | 2020-03-11 | A hard-coded encryption key vulnerability exists in the authentication functionality of WAGO e!Cockpit version 1.5.1.1. An attacker with access to communicatio… |
CVE-2020-4283 | High | 8.6 | 2020-03-02 | IBM Security Information Queue (ISIQ) 1.0.0, 1.0.1, 1.0.2, 1.0.3, and 1.0.4 contains hard-coded credentials, such as a password or cryptographic key, which it… |
CVE-2020-3165 | High | 8.2 | 2020-02-26 | A vulnerability in the implementation of Border Gateway Protocol (BGP) Message Digest 5 (MD5) authentication in Cisco NX-OS Software could allow an unauthentic… |
CVE-2019-5139 | High | 7.1 | 2020-02-25 | An exploitable use of hard-coded credentials vulnerability exists in multiple iw_* utilities of the Moxa AWK-3131A firmware version 1.13. The device operating… |
CVE-2019-5137 | High | 7.5 | 2020-02-25 | The usage of hard-coded cryptographic keys within the ServiceAgent binary allows for the decryption of captured traffic across the network from or to the Moxa… |
CVE-2020-3158 | Critical | 9.1 | 2020-02-19 | A vulnerability in the High Availability (HA) service of Cisco Smart Software Manager On-Prem could allow an unauthenticated, remote attacker to access a sensi… |
CVE-2014-9614 | Critical | 9.8 | 2020-02-19 | The Web Panel in Netsweeper before 4.0.5 has a default password of branding for the branding account, which makes it easier for remote attackers to obtain acce… |
CVE-2019-4392 | Critical | 9.8 | 2020-02-14 | HCL AppScan Standard Edition 9.0.3.13 and earlier uses hard-coded credentials which can be exploited by attackers to get unauthorized access to the system. |
CVE-2013-6362 | Critical | 9.8 | 2020-02-13 | Xerox ColorCube and WorkCenter devices in 2013 had hardcoded FTP and shell user accounts. |
CVE-2013-6277 | High | 7.5 | 2020-02-13 | QNAP VioCard 300 has hardcoded RSA private keys. |
CVE-2020-8964 | Critical | 9.8 | 2020-02-13 | TimeTools SC7105 1.0.007, SC9205 1.0.007, SC9705 1.0.007, SR7110 1.0.007, SR9210 1.0.007, SR9750 1.0.007, SR9850 1.0.007, T100 1.0.003, T300 1.0.003, and T550… |
CVE-2013-6236 | Critical | 9.8 | 2020-02-12 | IZON IP 2.0.2: hard-coded password vulnerability |
CVE-2012-6611 | Critical | 9.8 | 2020-02-10 | An issue was discovered in Polycom Web Management Interface G3/HDX 8000 HD with Durango 2.6.0 4740 software and embedded Polycom Linux Development Platform 2.1… |
CVE-2012-4381 | High | 8.1 | 2020-02-08 | MediaWiki before 1.18.5, and 1.19.x before 1.19.2 saves passwords in the local database, (1) which could make it easier for context-dependent attackers to obta… |
CVE-2020-8657 | Critical | 9.8 | 2020-02-06 | An issue was discovered in EyesOfNetwork 5.3. The installation uses the same API key (hardcoded as EONAPI_KEY in include/api_functions.php for API version 2.4… |
CVE-2019-4675 | Critical | 9.8 | 2020-02-04 | IBM Security Identity Manager 7.0.1 contains hard-coded credentials, such as a password or cryptographic key, which it uses for its own inbound authentication… |
CVE-2012-5686 | Critical | 9.8 | 2020-02-04 | ZPanel 10.0.1 has insufficient entropy for its password reset process. |
CVE-2020-5222 | Medium | 6.8 | 2020-01-30 | Opencast before 7.6 and 8.1 enables a remember-me cookie based on a hash created from the username, password, and an additional system key. This means that an… |
CVE-2013-1352 | High | 7.5 | 2020-01-30 | Verax NMS prior to 2.1.0 uses an encryption key that is hardcoded in a JAR archive. |
CVE-2013-2572 | High | 7.5 | 2020-01-29 | A Security Bypass vulnerability exists in TP-LINK IP Cameras TL-SC 3130, TL-SC 3130G, 3171G, 4171G, and 3130 1.6.18P12 due to default hard-coded credentials fo… |
CVE-2013-2567 | High | 7.5 | 2020-01-29 | An Authentication Bypass vulnerability exists in the web interface in Zavio IP Cameras through 1.6.03 due to a hardcoded admin account found in boa.conf, which… |
CVE-2013-1603 | Medium | 5.3 | 2020-01-28 | An Authentication vulnerability exists in D-LINK WCS-1100 1.02, TESCO DCS-2121 1.05_TESCO, TESCO DCS-2102 1.05_TESCO, DCS-7510 1.00, DCS-7410 1.00, DCS-6410 1… |
CVE-2020-8001 | Critical | 9.8 | 2020-01-27 | The Intellian Aptus application 1.0.2 for Android has a hardcoded password of intellian for the masteruser FTP account. |
CVE-2020-8000 | Critical | 9.8 | 2020-01-27 | Intellian Aptus Web 1.24 has a hardcoded password of 12345678 for the intellian account. |
CVE-2020-7999 | Critical | 9.8 | 2020-01-27 | The Intellian Aptus application 1.0.2 for Android has hardcoded values for DOWNLOAD_API_KEY and FILE_DOWNLOAD_API_KEY. |
CVE-2020-6963 | Critical | 10.0 | 2020-01-24 | In ApexPro Telemetry Server Versions 4.2 and prior, CARESCAPE Telemetry Server v4.2 & prior, Clinical Information Center (CIC) Versions 4.X and 5.X, CARESCAPE… |
CVE-2019-16153 | Critical | 9.8 | 2020-01-23 | A hard-coded password vulnerability in the Fortinet FortiSIEM database component version 5.2.5 and below may allow attackers to access the device database via… |
CVE-2020-6857 | Medium | 5.5 | 2020-01-21 | CarbonFTP v1.4 uses insecure proprietary password encryption with a hard-coded weak encryption key. The key for local FTP server passwords is hard-coded in the… |
CVE-2019-9493 | Medium | 6.5 | 2020-01-15 | The MyCar Controls of AutoMobility Distribution Inc., mobile application contains hard-coded admin credentials. A remote unauthenticated attacker may be able t… |
CVE-2019-10995 | High | 8.8 | 2020-01-14 | ABB CP651 HMI products revision BSP UN30 v1.76 and prior implement hidden administrative accounts that are used during the provisioning phase of the HMI interf… |
CVE-2019-14919 | High | 7.8 | 2020-01-09 | An exposed Telnet Service on the Billion Smart Energy Router SG600R2 with firmware v3.02.rc6 allows a local network attacker to authenticate via hardcoded cred… |
CVE-2019-14837 | Critical | 9.1 | 2020-01-07 | A flaw was found in keycloack before version 8.0.0. The owner of 'placeholder.org' domain can setup mail server on this domain and knowing only name of a clien… |
CVE-2019-15977 | High | 7.5 | 2020-01-06 | Multiple vulnerabilities in the authentication mechanisms of Cisco Data Center Network Manager (DCNM) could allow an unauthenticated, remote attacker to bypass… |
CVE-2019-15976 | Critical | 9.8 | 2020-01-06 | Multiple vulnerabilities in the authentication mechanisms of Cisco Data Center Network Manager (DCNM) could allow an unauthenticated, remote attacker to bypass… |
CVE-2019-15975 | Critical | 9.8 | 2020-01-06 | Multiple vulnerabilities in the authentication mechanisms of Cisco Data Center Network Manager (DCNM) could allow an unauthenticated, remote attacker to bypass… |
CVE-2013-3619 | High | 8.1 | 2020-01-02 | Intelligent Platform Management Interface (IPMI) with firmware for Supermicro X9 generation motherboards before SMT_X9_317 and firmware for Supermicro X8 gener… |
CVE-2019-18831 | Medium | 5.3 | 2019-12-16 | Barco ClickShare Button R9861500D01 devices before 1.9.0 allow Information Exposure. The encrypted ClickShare Button firmware contains the private key of a tes… |
CVE-2019-16734 | Critical | 9.8 | 2019-12-13 | Use of default credentials for the TELNET server in Petwant PF-103 firmware 4.3.2.50 and Petalk AI 3.2.2.30 allows remote attackers to execute arbitrary system… |
CVE-2014-0175 | Critical | 9.8 | 2019-12-13 | mcollective has a default password set at install |
CVE-2019-10694 | Critical | 9.8 | 2019-12-12 | The express install, which is the suggested way to install Puppet Enterprise, gives the user a URL at the end of the install to set the admin password. If they… |
CVE-2019-3983 | Medium | 6.8 | 2019-12-11 | Blink XT2 Sync Module firmware prior to 2.13.11 allows remote attackers to execute arbitrary code and commands on the device due to insufficient UART protectio… |
CVE-2013-3542 | Critical | 10.0 | 2019-12-11 | Grandstream GXV3501, GXV3504, GXV3601, GXV3601HD/LL, GXV3611HD/LL, GXV3615W/P, GXV3651FHD, GXV3662HD, GXV3615WP_HD, GXV3500, and possibly other camera models w… |
CVE-2019-19021 | Critical | 9.8 | 2019-12-02 | An issue was discovered in TitanHQ WebTitan before 5.18. It has a hidden support account (with a hard-coded password) in the web administration interface, with… |
CVE-2019-19017 | High | 8.1 | 2019-12-02 | An issue was discovered in TitanHQ WebTitan before 5.18. The appliance has a hard-coded root password set during installation. An attacker could utilize this t… |
CVE-2019-19492 | Critical | 9.8 | 2019-12-02 | FreeSWITCH 1.6.10 through 1.10.1 has a default password in event_socket.conf.xml. |
CVE-2019-19033 | Critical | 9.8 | 2019-11-21 | Jalios JCMS 10 allows attackers to access any part of the website and the WebDAV server with administrative privileges via a backdoor account, by using any use… |
CVE-2019-6693 | Medium | 6.5 | 2019-11-21 | Use of a hard-coded cryptographic key to cipher sensitive data in FortiOS configuration backup file may allow an attacker with access to the backup file to dec… |
CVE-2018-9195 | Medium | 5.9 | 2019-11-21 | Use of a hardcoded cryptographic key in the FortiGuard services communication protocol may allow a Man in the middle with knowledge of the key to eavesdrop on… |
CVE-2019-15802 | Medium | 5.9 | 2019-11-14 | An issue was discovered on Zyxel GS1900 devices with firmware before 2.50(AAHH.0)C0. The firmware hashes and encrypts passwords using a hardcoded cryptographic… |
CVE-2019-15801 | High | 7.5 | 2019-11-14 | An issue was discovered on Zyxel GS1900 devices with firmware before 2.50(AAHH.0)C0. The firmware image contains encrypted passwords that are used to authentic… |
CVE-2019-13543 | Medium | 5.8 | 2019-11-08 | Medtronic Valleylab Exchange Client version 3.4 and below, Valleylab FT10 Energy Platform (VLFT10GEN) software version 4.0.0 and below, and Valleylab FX8 Energ… |
CVE-2019-16207 | High | 7.8 | 2019-11-08 | Brocade SANnav versions before v2.0 use a hard-coded password, which could allow local authenticated attackers to access a back-end database and gain privilege… |
CVE-2015-7276 | Medium | 5.9 | 2019-11-06 | Technicolor C2000T and C2100T uses hard-coded cryptographic keys. |
CVE-2018-18929 | High | 8.8 | 2019-10-29 | The Tightrope Media Carousel Seneca HDn Windows-based appliance 7.0.4.104 is shipped with a default local administrator username and password. This can be foun… |
CVE-2019-4309 | Medium | 5.5 | 2019-10-29 | IBM Security Guardium Big Data Intelligence (SonarG) 4.0 uses hard coded credentials which could allow a local user to obtain highly sensitive information. IBM… |
CVE-2019-14930 | Critical | 9.8 | 2019-10-28 | An issue was discovered on Mitsubishi Electric Europe B.V. ME-RTU devices through 2.02 and INEA ME-RTU devices through 3.0. Undocumented hard-coded user passwo… |
CVE-2019-14926 | Critical | 9.8 | 2019-10-28 | An issue was discovered on Mitsubishi Electric Europe B.V. ME-RTU devices through 2.02 and INEA ME-RTU devices through 3.0. Hard-coded SSH keys allow an attack… |
CVE-2019-13553 | Critical | 9.8 | 2019-10-25 | Rittal Chiller SK 3232-Series web interface as built upon Carel pCOWeb firmware A1.5.3 – B1.2.4. The authentication mechanism on affected systems is configured… |
CVE-2016-2360 | Critical | 9.8 | 2019-10-25 | Milesight IP security cameras through 2016-11-14 have a default root password in /etc/shadow that is the same across different customers' installations. |
CVE-2016-2358 | Critical | 9.8 | 2019-10-25 | Milesight IP security cameras through 2016-11-14 have a default set of 10 privileged accounts with hardcoded credentials. They are accessible if the customer h… |
CVE-2016-2357 | Critical | 9.8 | 2019-10-25 | Milesight IP security cameras through 2016-11-14 have a hardcoded SSL private key under the /etc/config directory. |
CVE-2019-13657 | Critical | 9.8 | 2019-10-17 | CA Performance Management 3.5.x, 3.6.x before 3.6.9, and 3.7.x before 3.7.4 have a default credential vulnerability that can allow a remote attacker to execute… |
CVE-2019-9533 | Critical | 9.8 | 2019-10-10 | The root password of the Cobham EXPLORER 710 is the same for all versions of firmware up to and including v1.08. This could allow an attacker to reverse-engine… |
CVE-2019-15017 | High | 8.4 | 2019-10-09 | The SSH service is enabled on the Zingbox Inspector versions 1.294 and earlier, exposing SSH to the local network. When combined with PAN-SA-2019-0027, this ca… |
CVE-2019-15015 | High | 8.4 | 2019-10-09 | In the Zingbox Inspector, versions 1.294 and earlier, hardcoded credentials for root and inspector user accounts are present in the system software, which can… |
CVE-2019-13658 | Critical | 9.8 | 2019-10-02 | CA Network Flow Analysis 9.x and 10.0.x have a default credential vulnerability that can allow a remote attacker to execute arbitrary commands and compromise s… |
CVE-2019-13466 | High | 7.5 | 2019-09-30 | Western Digital SSD Dashboard before 2.5.1.0 and SanDisk SSD Dashboard before 2.5.1.0 have Incorrect Access Control. The “generate reports” archive is protecte… |
CVE-2019-10990 | Medium | 6.5 | 2019-09-23 | Red Lion Controls Crimson, version 3.0 and prior and version 3.1 prior to release 3112.00, uses a hard-coded password to encrypt protected files in transit and… |
CVE-2019-16399 | Critical | 9.8 | 2019-09-18 | Western Digital WD My Book World through II 1.02.12 suffers from Broken Authentication, which allows an attacker to access the /admin/ directory without creden… |
CVE-2019-13474 | Critical | 9.8 | 2019-09-16 | TELESTAR Bobs Rock Radio, Dabman D10, Dabman i30 Stereo, Imperial i110, Imperial i150, Imperial i200, Imperial i200-cd, Imperial i400, Imperial i450, Imperial… |
CVE-2019-16313 | High | 7.5 | 2019-09-14 | ifw8 Router ROM v4.31 allows credential disclosure by reading the action/usermanager.htm HTML source code. |
CVE-2019-13530 | High | 7.2 | 2019-09-12 | Philips IntelliVue WLAN, portable patient monitors, WLAN Version A, Firmware A.03.09, WLAN Version A, Firmware A.03.09, Part #: M8096-67501, WLAN Version B, Fi… |
CVE-2019-11898 | Critical | 9.9 | 2019-09-12 | Unauthorized APE administration privileges can be achieved by reverse engineering one of the APE service tools. The service tool is discontinued with Bosch Acc… |
CVE-2019-13473 | Critical | 9.8 | 2019-09-11 | TELESTAR Bobs Rock Radio, Dabman D10, Dabman i30 Stereo, Imperial i110, Imperial i150, Imperial i200, Imperial i200-cd, Imperial i400, Imperial i450, Imperial… |
CVE-2019-15867 | High | 8.8 | 2019-09-03 | The slick-popup plugin before 1.7.2 for WordPress has a hardcoded OmakPass13# password for the slickpopupteam account, after a Subscriber calls a certain AJAX… |
CVE-2019-15745 | High | 8.8 | 2019-08-29 | The Eques elf smart plug and the mobile app use a hardcoded AES 256 bit key to encrypt the commands and responses between the device and the app. The communica… |
CVE-2019-14943 | Critical | 9.8 | 2019-08-29 | An issue was discovered in GitLab Community and Enterprise Edition 12.0 through 12.1.4. It uses Hard-coded Credentials. |
CVE-2019-15497 | Critical | 9.8 | 2019-08-26 | Black Box iCOMPEL 9.2.3 through 11.1.4, as used in ONELAN Net-Top-Box 9.2.3 through 11.1.4 and other products, has default credentials that allow remote attack… |
CVE-2019-6698 | Critical | 9.8 | 2019-08-23 | Use of Hard-coded Credentials vulnerability in FortiRecorder all versions below 2.7.4 may allow an unauthenticated attacker with knowledge of the aforementione… |
CVE-2016-10928 | High | 7.5 | 2019-08-22 | The onelogin-saml-sso plugin before 2.2.0 for WordPress has a hardcoded @@@nopass@@@ password for just-in-time provisioned users. |
CVE-2019-11030 | Critical | 9.8 | 2019-08-22 | Mirasys VMS before V7.6.1 and 8.x before V8.3.2 mishandles the Mirasys.Common.Utils.Security.DataCrypt method in Common.dll in AuditTrailService in SMServer.ex… |
CVE-2019-1935 | Critical | 9.8 | 2019-08-21 | A vulnerability in Cisco Integrated Management Controller (IMC) Supervisor, Cisco UCS Director, and Cisco UCS Director Express for Big Data could allow an unau… |
CVE-2019-7594 | Medium | 6.8 | 2019-08-20 | Metasys® ADS/ADX servers and NAE/NIE/NCE engines prior to 9.0 make use of a hardcoded RC2 key for certain encryption operations involving the Site Management P… |
CVE-2019-7593 | Medium | 6.8 | 2019-08-20 | Metasys® ADS/ADX servers and NAE/NIE/NCE engines prior to 9.0 make use of a shared RSA key pair for certain encryption operations involving the Site Management… |
CVE-2018-20955 | Critical | 9.8 | 2019-08-08 | Swann SWWHD-INTCAM-HD devices have the twipc root password, leading to FTP access as root. NOTE: all affected customers were migrated by 2020-08-31. |