CWE-798 · Use of Hard-coded Credentials (page 16)
Page 16 of 18 — CVEs classified under CWE-798, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2019-3908 | High | 7.5 | 2019-01-18 | Premisys Identicard version 3.1.190 stores backup files as encrypted zip files. The password to the zip is hard-coded and unchangeable. An attacker with access… |
CVE-2019-3907 | High | 7.5 | 2019-01-18 | Premisys Identicard version 3.1.190 stores user credentials and other sensitive information with a known weak encryption method (MD5 hash of a salt and passwor… |
CVE-2019-3906 | High | 8.8 | 2019-01-18 | Premisys Identicard version 3.1.190 contains hardcoded credentials in the WCF service on port 9003. An authenticated remote attacker can use these credentials… |
CVE-2019-0022 | Critical | 10.0 | 2019-01-15 | Juniper ATP ships with hard coded credentials in the Cyphort Core instance which gives an attacker the ability to take full control of any installation of the… |
CVE-2019-0020 | Critical | 10.0 | 2019-01-15 | Juniper ATP ships with hard coded credentials in the Web Collector instance which gives an attacker the ability to take full control of any installation of the… |
CVE-2018-16201 | High | 8.8 | 2019-01-09 | Toshiba Home gateway HEM-GW16A 1.2.9 and earlier, Toshiba Home gateway HEM-GW26A 1.2.9 and earlier uses hard-coded credentials, which may allow an attacker on… |
CVE-2018-16186 | High | 8.8 | 2019-01-09 | RICOH Interactive Whiteboard D2200 V1.1 to V2.2, D5500 V1.1 to V2.2, D5510 V1.1 to V2.2, the display versions with RICOH Interactive Whiteboard Controller Type… |
CVE-2018-1000625 | Critical | 9.8 | 2018-12-28 | Battelle V2I Hub 2.5.1 contains hard-coded credentials for the administrative account. An attacker could exploit this vulnerability to log in as an admin on an… |
CVE-2018-7800 | Critical | 9.8 | 2018-12-24 | A Hard-coded Credentials vulnerability exists in EVLink Parking, v3.2.0-12_v1 and earlier, which could enable an attacker to gain access to the device. |
CVE-2018-18009 | Critical | 9.8 | 2018-12-21 | dirary0.js on D-Link DIR-140L, DIR-640L devices allows remote unauthenticated attackers to discover admin credentials. |
CVE-2018-18008 | Critical | 9.8 | 2018-12-21 | spaces.htm on multiple D-Link devices (DSL, DIR, DWR) allows remote unauthenticated attackers to discover admin credentials. |
CVE-2018-18007 | Critical | 9.8 | 2018-12-21 | atbox.htm on D-Link DSL-2770L devices allows remote unauthenticated attackers to discover admin credentials. |
CVE-2018-15720 | Critical | 9.8 | 2018-12-20 | Logitech Harmony Hub before version 4.15.206 contained two hard-coded accounts in the XMPP server that gave remote users access to the local API. |
CVE-2018-19233 | High | 7.8 | 2018-12-20 | COMPAREX Miss Marple Enterprise Edition before 2.0 allows local users to execute arbitrary code by reading the user name and encrypted password hard-coded in a… |
CVE-2018-18006 | Critical | 9.8 | 2018-12-14 | Hardcoded credentials in the Ricoh myPrint application 2.9.2.4 for Windows and 2.2.7 for Android give access to any externally disclosed myPrint WSDL API, as d… |
CVE-2018-1887 | Medium | 5.9 | 2018-12-13 | IBM Security Access Manager Appliance 9.0.1.0, 9.0.2.0, 9.0.3.0, 9.0.4.0, and 9.0.5.0 contains hard-coded credentials, such as a password or cryptographic key… |
CVE-2018-1818 | Medium | 5.9 | 2018-12-13 | IBM Security Guardium 10 and 10.5 contains hard-coded credentials, such as a password or cryptographic key, which it uses for its own inbound authentication, o… |
CVE-2018-1650 | Medium | 5.9 | 2018-12-05 | IBM QRadar SIEM 7.2 and 7.3 uses hard-coded credentials which could allow an attacker to bypass the authentication configured by the administrator. IBM X-Force… |
CVE-2018-0468 | High | 7.8 | 2018-12-04 | A vulnerability in the configuration of a local database installed as part of the Cisco Energy Management Suite (CEMS) could allow an authenticated, local atta… |
CVE-2018-9083 | High | 8.1 | 2018-11-27 | In System Management Module (SMM) versions prior to 1.06, the SMM contains weak default root credentials which could be used to log in to the device OS -- if t… |
CVE-2018-9073 | Medium | 5.9 | 2018-11-16 | Lenovo Chassis Management Module (CMM) prior to version 2.0.0 utilizes a hardcoded encryption key to protect certain secrets. Possession of the key can allow a… |
CVE-2018-0681 | Critical | 9.8 | 2018-11-15 | Denbun by NEOJAPAN Inc. (Denbun POP version V3.3P R4.0 and earlier, Denbun IMAP version V3.3I R4.0 and earlier) uses hard-coded credentials, which may allow re… |
CVE-2018-0680 | Critical | 9.8 | 2018-11-15 | Denbun by NEOJAPAN Inc. (Denbun POP version V3.3P R4.0 and earlier, Denbun IMAP version V3.3I R4.0 and earlier) uses hard-coded credentials, which may allow re… |
CVE-2018-15439 | Critical | 9.8 | 2018-11-08 | A vulnerability in the Cisco Small Business Switches software could allow an unauthenticated, remote attacker to bypass the user authentication mechanism of an… |
CVE-2018-19069 | Critical | 9.8 | 2018-11-07 | An issue was discovered on Foscam C2 devices with System Firmware 1.11.1.8 and Application Firmware 2.72.1.32, and Opticam i5 devices with System Firmware 1.5… |
CVE-2018-19067 | Critical | 9.8 | 2018-11-07 | An issue was discovered on Foscam C2 devices with System Firmware 1.11.1.8 and Application Firmware 2.72.1.32, and Opticam i5 devices with System Firmware 1.5… |
CVE-2018-19066 | High | 7.5 | 2018-11-07 | An issue was discovered on Foscam C2 devices with System Firmware 1.11.1.8 and Application Firmware 2.72.1.32, and Opticam i5 devices with System Firmware 1.5… |
CVE-2018-19065 | High | 7.5 | 2018-11-07 | An issue was discovered on Foscam C2 devices with System Firmware 1.11.1.8 and Application Firmware 2.72.1.32, and Opticam i5 devices with System Firmware 1.5… |
CVE-2018-19063 | Critical | 9.8 | 2018-11-07 | An issue was discovered on Foscam C2 devices with System Firmware 1.11.1.8 and Application Firmware 2.72.1.32, and Opticam i5 devices with System Firmware 1.5… |
CVE-2018-11062 | High | 8.8 | 2018-11-02 | Integrated Data Protection Appliance versions 2.0, 2.1, and 2.2 contain undocumented accounts named 'support' and 'admin' that are protected with default passw… |
CVE-2018-10532 | High | 8.8 | 2018-10-30 | An issue was discovered on EE 4GEE HH70VB-2BE8GB3 HH70_E1_02.00_19 devices. Hardcoded root SSH credentials were discovered to be stored within the "core_app" b… |
CVE-2018-13342 | Critical | 9.8 | 2018-10-24 | The server API in the Anda app relies on hardcoded credentials. |
CVE-2018-12668 | Critical | 9.8 | 2018-10-19 | SV3C L-SERIES HD CAMERA V2.3.4.2103-S50-NTD-B20170508B and V2.3.4.2103-S50-NTD-B20170823B devices have a Hard-coded Password. |
CVE-2018-17896 | High | 8.1 | 2018-10-12 | Yokogawa STARDOM Controllers FCJ, FCN-100, FCN-RTU, FCN-500, All versions R4.10 and prior, The affected controllers utilize hard-coded credentials which may al… |
CVE-2018-17894 | Critical | 9.8 | 2018-10-12 | NUUO CMS all versions 3.1 and prior, The application creates default accounts that have hard-coded passwords, which could allow an attacker to gain privileged… |
CVE-2018-17919 | Medium | 6.5 | 2018-10-10 | All versions of Hangzhou Xiongmai Technology Co., Ltd XMeye P2P Cloud Server may allow an attacker to use an undocumented user account "default" with its defau… |
CVE-2018-5399 | Critical | 9.4 | 2018-10-08 | The Auto-Maskin DCU 210E firmware contains an undocumented Dropbear SSH server, v2015.55, configured to listen on Port 22 while the DCU is running. The Dropbea… |
CVE-2018-1742 | Medium | 5.9 | 2018-10-08 | IBM Tivoli Key Lifecycle Manager 2.6, 2.7, and 3.0 contains hard-coded credentials, such as a password or cryptographic key, which it uses for its own inbound… |
CVE-2018-15427 | Critical | 9.8 | 2018-10-05 | A vulnerability in Cisco Video Surveillance Manager (VSM) Software running on certain Cisco Connected Safety and Security Unified Computing System (UCS) platfo… |
CVE-2018-15389 | Critical | 9.8 | 2018-10-05 | A vulnerability in the install function of Cisco Prime Collaboration Provisioning (PCP) could allow an unauthenticated, remote attacker to access the administr… |
CVE-2018-15753 | High | 7.5 | 2018-10-02 | An issue was discovered in the MensaMax (aka com.breustedt.mensamax) application 4.3 for Android. The use of a Hard-coded DES Cryptographic Key allows an attac… |
CVE-2018-17217 | High | 7.5 | 2018-10-01 | An issue was discovered in PTC ThingWorx Platform 6.5 through 8.2. There is a hardcoded encryption key. |
CVE-2018-8856 | Critical | 9.8 | 2018-09-26 | Philips e-Alert Unit (non-medical device), Version R2.1 and prior. The software contains hard-coded cryptographic key, which it uses for encryption of internal… |
CVE-2018-16957 | Critical | 9.8 | 2018-09-18 | The Oracle WebCenter Interaction 10.3.3 search service queryd.exe binary is compiled with the i1g2s3c4 hardcoded password. Authentication to the Oracle WCI sea… |
CVE-2018-0663 | High | 8.8 | 2018-09-07 | Multiple I-O DATA network camera products (TS-WRLP firmware Ver.1.09.04 and earlier, TS-WRLA firmware Ver.1.09.04 and earlier, TS-WRLP/E firmware Ver.1.09.04 a… |
CVE-2018-16546 | Medium | 5.9 | 2018-09-05 | Amcrest networked devices use the same hardcoded SSL private key across different customers' installations, which allows remote attackers to defeat cryptograph… |
CVE-2018-14901 | High | 7.5 | 2018-08-30 | The EPSON iPrint application 6.6.3 for Android contains hard-coded API and Secret keys for the Dropbox, Box, Evernote and OneDrive services. |
CVE-2018-13820 | High | 7.5 | 2018-08-30 | A hardcoded passphrase, in CA Unified Infrastructure Management 8.5.1, 8.5, and 8.4.7, allows attackers to access sensitive information. |
CVE-2018-13819 | High | 7.5 | 2018-08-30 | A hardcoded secret key, in CA Unified Infrastructure Management 8.5.1, 8.5, and 8.4.7, allows attackers to access sensitive information. |
CVE-2018-16158 | Critical | 9.8 | 2018-08-30 | Eaton Power Xpert Meter 4000, 6000, and 8000 devices before 13.4.0.10 have a single SSH private key across different customers' installations and do not proper… |
CVE-2018-12240 | Medium | 5.9 | 2018-08-29 | The Norton Identity Safe product prior to 5.3.0.976 may be susceptible to a privilege escalation issue via a hard coded IV, which is a type of vulnerability th… |
CVE-2017-9821 | Critical | 9.8 | 2018-08-24 | The National Payments Corporation of India BHIM application 1.3 for Android relies on three hardcoded strings (AK-NPCIMB, IM-NPCIBM, and VK-NPCIBM) for SMS val… |
CVE-2017-12577 | Critical | 9.8 | 2018-08-24 | An issue was discovered on the PLANEX CS-QR20 1.30. A hardcoded account / password ("admin:password") is used in the Android application that allows attackers… |
CVE-2017-12574 | Critical | 9.8 | 2018-08-24 | An issue was discovered on PLANEX CS-W50HD devices with firmware before 030720. A hardcoded credential "supervisor:dangerous" was injected into web authenticat… |
CVE-2018-15808 | Critical | 9.8 | 2018-08-23 | POSIM EVO 15.13 for Windows includes hardcoded database credentials for the "root" database user. "root" access to POSIM EVO's database may result in a breach… |
CVE-2018-14801 | Medium | 6.2 | 2018-08-22 | In Philips PageWriter TC10, TC20, TC30, TC50, TC70 Cardiographs, all versions prior to May 2018, an attacker with both the superuser password and physical acce… |
CVE-2018-15491 | High | 7.5 | 2018-08-18 | A vulnerability in the permission and encryption implementation of Zemana Anti-Logger 1.9.3.527 and prior (fixed in 1.9.3.602) allows an attacker to take contr… |
CVE-2018-15360 | High | 7.3 | 2018-08-17 | An attacker without authentication can login with default credentials for privileged users in Eltex ESP-200 firmware version 1.2.0. |
CVE-2018-11509 | Critical | 9.8 | 2018-08-16 | ASUSTOR ADM 3.1.0.RFQ3 uses the same default root:admin username and password as it does for the NAS itself for applications that are installed from the online… |
CVE-2017-13108 | High | 7.5 | 2018-08-15 | DFNDR Security Antivirus, Anti-hacking & Cleaner, 5.0.9, 2017-11-01, Android application uses a hard-coded key for encryption. Data stored using this key can b… |
CVE-2017-13107 | High | 7.5 | 2018-08-15 | Live.me - live stream video chat, 3.7.20, 2017-11-06, Android application uses a hard-coded key for encryption. Data stored using this key can be decrypted by… |
CVE-2017-13106 | High | 7.5 | 2018-08-15 | Cheetahmobile CM Launcher 3D - Theme, wallpaper, Secure, Efficient, 5.0.3, 2017-09-19, Android application uses a hard-coded key for encryption. Data stored us… |
CVE-2017-13104 | High | 7.5 | 2018-08-15 | Uber Technologies, Inc. UberEATS: Uber for Food Delivery, 1.108.10001, 2017-11-02, iOS application uses a hard-coded key for encryption. Data stored using this… |
CVE-2017-13102 | High | 7.5 | 2018-08-15 | Gameloft Asphalt Xtreme: Offroad Rally Racing, 1.6.0, 2017-08-13, iOS application uses a hard-coded key for encryption. Data stored using this key can be decry… |
CVE-2017-13101 | High | 7.5 | 2018-08-15 | Musical.ly Inc., musical.ly - your video social network, 6.1.6, 2017-10-03, iOS application uses a hard-coded key for encryption. Data stored using this key ca… |
CVE-2017-13100 | High | 7.5 | 2018-08-15 | DistinctDev, Inc., The Moron Test, 6.3.1, 2017-05-04, iOS application uses a hard-coded key for encryption. Data stored using this key can be decrypted by anyo… |
CVE-2018-14943 | Critical | 9.8 | 2018-08-05 | Harmonic NSG 9000 devices have a default password of nsgadmin for the admin account, a default password of nsgguest for the guest account, and a default passwo… |
CVE-2018-10592 | Critical | 9.8 | 2018-07-31 | Yokogawa STARDOM FCJ controllers R4.02 and prior, FCN-100 controllers R4.02 and prior, FCN-RTU controllers R4.02 and prior, and FCN-500 controllers R4.02 and p… |
CVE-2018-10898 | High | 8.8 | 2018-07-30 | A vulnerability was found in openstack-tripleo-heat-templates before version 8.0.2-40. When deployed using Director using default configuration, Opendaylight i… |
CVE-2018-9068 | High | 7.5 | 2018-07-26 | The IMM2 First Failure Data Capture function collects management module logs and diagnostic information when a hardware error is detected. This information is… |
CVE-2017-7537 | Medium | 5.9 | 2018-07-26 | It was found that a mock CMC authentication plugin with a hardcoded secret was accidentally enabled by default in the pki-core package before 10.6.4. An attack… |
CVE-2018-0375 | Critical | 9.8 | 2018-07-18 | A vulnerability in the Cluster Manager of Cisco Policy Suite before 18.2.0 could allow an unauthenticated, remote attacker to log in to an affected system usin… |
CVE-2018-14324 | Critical | 9.8 | 2018-07-16 | The demo feature in Oracle GlassFish Open Source Edition 5.0 has TCP port 7676 open by default with a password of admin for the admin account. This allows remo… |
CVE-2016-9495 | High | 8.8 | 2018-07-13 | Hughes high-performance broadband satellite modems, models HN7740S DW7000 HN7000S/SM, uses hard coded credentials. Access to the device's default telnet port (… |
CVE-2018-0041 | Critical | 9.8 | 2018-07-11 | Juniper Networks Contrail Service Orchestration releases prior to 3.3.0 use hardcoded credentials to access Keystone service. These credentials allow network b… |
CVE-2018-0040 | Critical | 9.8 | 2018-07-11 | Juniper Networks Contrail Service Orchestrator versions prior to 4.0.0 use hardcoded cryptographic certificates and keys in some cases, which may allow network… |
CVE-2018-0039 | Medium | 6.5 | 2018-07-11 | Juniper Networks Contrail Service Orchestration releases prior to 4.0.0 have Grafana service enabled by default with hardcoded credentials. These credentials a… |
CVE-2018-0038 | Critical | 9.8 | 2018-07-11 | Juniper Networks Contrail Service Orchestration releases prior to 3.3.0 have Cassandra service enabled by default with hardcoded credentials. These credentials… |
CVE-2018-10633 | Critical | 9.8 | 2018-07-11 | Universal Robots Robot Controllers Version CB 3.1, SW Version 3.4.5-100 utilizes hard-coded credentials that may allow an attacker to reset passwords for the c… |
CVE-2018-11641 | Critical | 9.8 | 2018-07-03 | Use of Hard-coded Credentials in /var/www/xms/application/controllers/gatherLogs.php in the administrative console in Dialogic PowerMedia XMS through 3.5 allow… |
CVE-2018-11635 | Critical | 9.8 | 2018-07-03 | Use of a Hard-coded Cryptographic Key used to protect cookie session data in /var/www/xms/application/config/config.php in the administrative console in Dialog… |
CVE-2018-8870 | Medium | 6.4 | 2018-07-03 | Medtronic 24950 MyCareLink Monitor and 24952 MyCareLink Monitor contains a hard-coded operating system password. An attacker with physical access can remove th… |
CVE-2018-12924 | Critical | 9.8 | 2018-06-28 | Sollae Serial-Ethernet-Module and Remote-I/O-Device-Server devices have a default password of sollae for the TELNET service. |
CVE-2018-4846 | Critical | 9.8 | 2018-06-26 | A vulnerability has been identified in RAPIDLab 1200 systems / RAPIDPoint 400 systems / RAPIDPoint 500 systems (All versions_without_ use of Siemens Healthinee… |
CVE-2018-12526 | Critical | 9.8 | 2018-06-21 | Telesquare SDT-CS3B1 and SDT-CW3B1 devices through 1.2.0 have a default factory account. Remote attackers can obtain access to the device via TELNET using a ha… |
CVE-2018-6213 | Critical | 9.8 | 2018-06-20 | In the web server on D-Link DIR-620 devices with a certain customized (by ISP) variant of firmware 1.0.3, 1.0.37, 1.3.1, 1.3.3, 1.3.7, 1.4.0, and 2.0.22, there… |
CVE-2018-6210 | Critical | 9.8 | 2018-06-19 | D-Link DIR-620 devices, with a certain Rostelekom variant of firmware 1.0.37, have a hardcoded rostel account, which makes it easier for remote attackers to ob… |
CVE-2018-12323 | Medium | 6.8 | 2018-06-13 | An issue was discovered on Momentum Axel 720P 5.1.8 devices. A password of EHLGVG is hard-coded for the root and admin accounts, which makes it easier for phys… |
CVE-2018-0329 | Medium | 5.3 | 2018-06-07 | A vulnerability in the default configuration of the Simple Network Management Protocol (SNMP) feature of Cisco Wide Area Application Services (WAAS) Software c… |
CVE-2018-10966 | High | 7.3 | 2018-06-05 | An issue was discovered in GamerPolls 0.4.6, related to config/environments/all.js and config/initializers/02_passport.js. An attacker can edit the Passport.js… |
CVE-2018-10813 | High | 7.3 | 2018-06-05 | In Dedos-web 1.0, the cookie and session secrets used in the Express.js application have hardcoded values that are visible in the source code published on GitH… |
CVE-2018-11682 | Critical | 9.8 | 2018-06-02 | Default and unremovable support credentials allow attackers to gain total super user control of an IoT device through a TELNET session to products using the St… |
CVE-2018-11681 | Critical | 9.8 | 2018-06-02 | Default and unremovable support credentials (user:nwk password:nwk2) allow attackers to gain total super user control of an IoT device through a TELNET session… |
CVE-2018-11629 | Critical | 9.8 | 2018-06-02 | Default and unremovable support credentials (user:lutron password:integration) allow attackers to gain total super user control of an IoT device through a TELN… |
CVE-2018-11482 | Critical | 9.8 | 2018-05-30 | /usr/lib/lua/luci/websys.lua on TP-LINK IPC TL-IPC223(P)-6, TL-IPC323K-D, TL-IPC325(KP)-*, and TL-IPC40A-4 devices has a hardcoded zMiVw8Kw0oxKXL0 password. |
CVE-2018-11311 | Critical | 9.1 | 2018-05-20 | A hardcoded FTP username of myscada and password of Vikuk63 in 'myscadagate.exe' in mySCADA myPRO 7 allows remote attackers to access the FTP server on port 21… |
CVE-2018-0222 | Critical | 10.0 | 2018-05-17 | A vulnerability in Cisco Digital Network Architecture (DNA) Center could allow an unauthenticated, remote attacker to log in to an affected system by using an… |
CVE-2018-11094 | Critical | 9.8 | 2018-05-15 | An issue was discovered on Intelbras NCLOUD 300 1.0 devices. /cgi-bin/ExportSettings.sh, /goform/updateWPS, /goform/RebootSystem, and /goform/vpnBasicSettings… |
CVE-2018-9112 | Critical | 9.8 | 2018-05-10 | A low privileged admin account with a weak default password of admin exists on the Foxconn FEMTO AP-FC4064-T AP_GT_B38_5.8.3lb15-W47 LTE Build 15. In addition… |
CVE-2016-9335 | Critical | 10.0 | 2018-05-09 | A hard-coded cryptographic key vulnerability was identified in Red Lion Controls Sixnet-Managed Industrial Switches running firmware Version 5.0.196 and Stride… |