CWE-798 · Use of Hard-coded Credentials (page 17)
Page 17 of 19 — CVEs classified under CWE-798, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2018-19069 | Critical | 9.8 | 2018-11-07 | An issue was discovered on Foscam C2 devices with System Firmware 1.11.1.8 and Application Firmware 2.72.1.32, and Opticam i5 devices with System Firmware 1.5… |
CVE-2018-19067 | Critical | 9.8 | 2018-11-07 | An issue was discovered on Foscam C2 devices with System Firmware 1.11.1.8 and Application Firmware 2.72.1.32, and Opticam i5 devices with System Firmware 1.5… |
CVE-2018-19066 | High | 7.5 | 2018-11-07 | An issue was discovered on Foscam C2 devices with System Firmware 1.11.1.8 and Application Firmware 2.72.1.32, and Opticam i5 devices with System Firmware 1.5… |
CVE-2018-19065 | High | 7.5 | 2018-11-07 | An issue was discovered on Foscam C2 devices with System Firmware 1.11.1.8 and Application Firmware 2.72.1.32, and Opticam i5 devices with System Firmware 1.5… |
CVE-2018-19063 | Critical | 9.8 | 2018-11-07 | An issue was discovered on Foscam C2 devices with System Firmware 1.11.1.8 and Application Firmware 2.72.1.32, and Opticam i5 devices with System Firmware 1.5… |
CVE-2018-11062 | High | 8.8 | 2018-11-02 | Integrated Data Protection Appliance versions 2.0, 2.1, and 2.2 contain undocumented accounts named 'support' and 'admin' that are protected with default passw… |
CVE-2018-10532 | High | 8.8 | 2018-10-30 | An issue was discovered on EE 4GEE HH70VB-2BE8GB3 HH70_E1_02.00_19 devices. Hardcoded root SSH credentials were discovered to be stored within the "core_app" b… |
CVE-2018-13342 | Critical | 9.8 | 2018-10-24 | The server API in the Anda app relies on hardcoded credentials. |
CVE-2018-12668 | Critical | 9.8 | 2018-10-19 | SV3C L-SERIES HD CAMERA V2.3.4.2103-S50-NTD-B20170508B and V2.3.4.2103-S50-NTD-B20170823B devices have a Hard-coded Password. |
CVE-2018-17896 | High | 8.1 | 2018-10-12 | Yokogawa STARDOM Controllers FCJ, FCN-100, FCN-RTU, FCN-500, All versions R4.10 and prior, The affected controllers utilize hard-coded credentials which may al… |
CVE-2018-17894 | Critical | 9.8 | 2018-10-12 | NUUO CMS all versions 3.1 and prior, The application creates default accounts that have hard-coded passwords, which could allow an attacker to gain privileged… |
CVE-2018-17919 | Medium | 6.5 | 2018-10-10 | All versions of Hangzhou Xiongmai Technology Co., Ltd XMeye P2P Cloud Server may allow an attacker to use an undocumented user account "default" with its defau… |
CVE-2018-5399 | Critical | 9.4 | 2018-10-08 | The Auto-Maskin DCU 210E firmware contains an undocumented Dropbear SSH server, v2015.55, configured to listen on Port 22 while the DCU is running. The Dropbea… |
CVE-2018-1742 | Medium | 5.9 | 2018-10-08 | IBM Tivoli Key Lifecycle Manager 2.6, 2.7, and 3.0 contains hard-coded credentials, such as a password or cryptographic key, which it uses for its own inbound… |
CVE-2018-15427 | Critical | 9.8 | 2018-10-05 | A vulnerability in Cisco Video Surveillance Manager (VSM) Software running on certain Cisco Connected Safety and Security Unified Computing System (UCS) platfo… |
CVE-2018-15389 | Critical | 9.8 | 2018-10-05 | A vulnerability in the install function of Cisco Prime Collaboration Provisioning (PCP) could allow an unauthenticated, remote attacker to access the administr… |
CVE-2018-15753 | High | 7.5 | 2018-10-02 | An issue was discovered in the MensaMax (aka com.breustedt.mensamax) application 4.3 for Android. The use of a Hard-coded DES Cryptographic Key allows an attac… |
CVE-2018-17217 | High | 7.5 | 2018-10-01 | An issue was discovered in PTC ThingWorx Platform 6.5 through 8.2. There is a hardcoded encryption key. |
CVE-2018-8856 | Critical | 9.8 | 2018-09-26 | Philips e-Alert Unit (non-medical device), Version R2.1 and prior. The software contains hard-coded cryptographic key, which it uses for encryption of internal… |
CVE-2018-16957 | Critical | 9.8 | 2018-09-18 | The Oracle WebCenter Interaction 10.3.3 search service queryd.exe binary is compiled with the i1g2s3c4 hardcoded password. Authentication to the Oracle WCI sea… |
CVE-2018-0663 | High | 8.8 | 2018-09-07 | Multiple I-O DATA network camera products (TS-WRLP firmware Ver.1.09.04 and earlier, TS-WRLA firmware Ver.1.09.04 and earlier, TS-WRLP/E firmware Ver.1.09.04 a… |
CVE-2018-16546 | Medium | 5.9 | 2018-09-05 | Amcrest networked devices use the same hardcoded SSL private key across different customers' installations, which allows remote attackers to defeat cryptograph… |
CVE-2018-14901 | High | 7.5 | 2018-08-30 | The EPSON iPrint application 6.6.3 for Android contains hard-coded API and Secret keys for the Dropbox, Box, Evernote and OneDrive services. |
CVE-2018-13820 | High | 7.5 | 2018-08-30 | A hardcoded passphrase, in CA Unified Infrastructure Management 8.5.1, 8.5, and 8.4.7, allows attackers to access sensitive information. |
CVE-2018-13819 | High | 7.5 | 2018-08-30 | A hardcoded secret key, in CA Unified Infrastructure Management 8.5.1, 8.5, and 8.4.7, allows attackers to access sensitive information. |
CVE-2018-16158 | Critical | 9.8 | 2018-08-30 | Eaton Power Xpert Meter 4000, 6000, and 8000 devices before 13.4.0.10 have a single SSH private key across different customers' installations and do not proper… |
CVE-2018-12240 | Medium | 5.9 | 2018-08-29 | The Norton Identity Safe product prior to 5.3.0.976 may be susceptible to a privilege escalation issue via a hard coded IV, which is a type of vulnerability th… |
CVE-2017-9821 | Critical | 9.8 | 2018-08-24 | The National Payments Corporation of India BHIM application 1.3 for Android relies on three hardcoded strings (AK-NPCIMB, IM-NPCIBM, and VK-NPCIBM) for SMS val… |
CVE-2017-12577 | Critical | 9.8 | 2018-08-24 | An issue was discovered on the PLANEX CS-QR20 1.30. A hardcoded account / password ("admin:password") is used in the Android application that allows attackers… |
CVE-2017-12574 | Critical | 9.8 | 2018-08-24 | An issue was discovered on PLANEX CS-W50HD devices with firmware before 030720. A hardcoded credential "supervisor:dangerous" was injected into web authenticat… |
CVE-2018-15808 | Critical | 9.8 | 2018-08-23 | POSIM EVO 15.13 for Windows includes hardcoded database credentials for the "root" database user. "root" access to POSIM EVO's database may result in a breach… |
CVE-2018-14801 | Medium | 6.2 | 2018-08-22 | In Philips PageWriter TC10, TC20, TC30, TC50, TC70 Cardiographs, all versions prior to May 2018, an attacker with both the superuser password and physical acce… |
CVE-2018-15491 | High | 7.5 | 2018-08-18 | A vulnerability in the permission and encryption implementation of Zemana Anti-Logger 1.9.3.527 and prior (fixed in 1.9.3.602) allows an attacker to take contr… |
CVE-2018-15360 | High | 7.3 | 2018-08-17 | An attacker without authentication can login with default credentials for privileged users in Eltex ESP-200 firmware version 1.2.0. |
CVE-2018-11509 | Critical | 9.8 | 2018-08-16 | ASUSTOR ADM 3.1.0.RFQ3 uses the same default root:admin username and password as it does for the NAS itself for applications that are installed from the online… |
CVE-2017-13108 | High | 7.5 | 2018-08-15 | DFNDR Security Antivirus, Anti-hacking & Cleaner, 5.0.9, 2017-11-01, Android application uses a hard-coded key for encryption. Data stored using this key can b… |
CVE-2017-13107 | High | 7.5 | 2018-08-15 | Live.me - live stream video chat, 3.7.20, 2017-11-06, Android application uses a hard-coded key for encryption. Data stored using this key can be decrypted by… |
CVE-2017-13106 | High | 7.5 | 2018-08-15 | Cheetahmobile CM Launcher 3D - Theme, wallpaper, Secure, Efficient, 5.0.3, 2017-09-19, Android application uses a hard-coded key for encryption. Data stored us… |
CVE-2017-13104 | High | 7.5 | 2018-08-15 | Uber Technologies, Inc. UberEATS: Uber for Food Delivery, 1.108.10001, 2017-11-02, iOS application uses a hard-coded key for encryption. Data stored using this… |
CVE-2017-13102 | High | 7.5 | 2018-08-15 | Gameloft Asphalt Xtreme: Offroad Rally Racing, 1.6.0, 2017-08-13, iOS application uses a hard-coded key for encryption. Data stored using this key can be decry… |
CVE-2017-13101 | High | 7.5 | 2018-08-15 | Musical.ly Inc., musical.ly - your video social network, 6.1.6, 2017-10-03, iOS application uses a hard-coded key for encryption. Data stored using this key ca… |
CVE-2017-13100 | High | 7.5 | 2018-08-15 | DistinctDev, Inc., The Moron Test, 6.3.1, 2017-05-04, iOS application uses a hard-coded key for encryption. Data stored using this key can be decrypted by anyo… |
CVE-2018-14943 | Critical | 9.8 | 2018-08-05 | Harmonic NSG 9000 devices have a default password of nsgadmin for the admin account, a default password of nsgguest for the guest account, and a default passwo… |
CVE-2018-10592 | Critical | 9.8 | 2018-07-31 | Yokogawa STARDOM FCJ controllers R4.02 and prior, FCN-100 controllers R4.02 and prior, FCN-RTU controllers R4.02 and prior, and FCN-500 controllers R4.02 and p… |
CVE-2018-10898 | High | 8.8 | 2018-07-30 | A vulnerability was found in openstack-tripleo-heat-templates before version 8.0.2-40. When deployed using Director using default configuration, Opendaylight i… |
CVE-2018-9068 | High | 7.5 | 2018-07-26 | The IMM2 First Failure Data Capture function collects management module logs and diagnostic information when a hardware error is detected. This information is… |
CVE-2017-7537 | Medium | 5.9 | 2018-07-26 | It was found that a mock CMC authentication plugin with a hardcoded secret was accidentally enabled by default in the pki-core package before 10.6.4. An attack… |
CVE-2018-0375 | Critical | 9.8 | 2018-07-18 | A vulnerability in the Cluster Manager of Cisco Policy Suite before 18.2.0 could allow an unauthenticated, remote attacker to log in to an affected system usin… |
CVE-2018-14324 | Critical | 9.8 | 2018-07-16 | The demo feature in Oracle GlassFish Open Source Edition 5.0 has TCP port 7676 open by default with a password of admin for the admin account. This allows remo… |
CVE-2016-9495 | High | 8.8 | 2018-07-13 | Hughes high-performance broadband satellite modems, models HN7740S DW7000 HN7000S/SM, uses hard coded credentials. Access to the device's default telnet port (… |
CVE-2018-0041 | Critical | 9.8 | 2018-07-11 | Juniper Networks Contrail Service Orchestration releases prior to 3.3.0 use hardcoded credentials to access Keystone service. These credentials allow network b… |
CVE-2018-0040 | Critical | 9.8 | 2018-07-11 | Juniper Networks Contrail Service Orchestrator versions prior to 4.0.0 use hardcoded cryptographic certificates and keys in some cases, which may allow network… |
CVE-2018-0039 | Medium | 6.5 | 2018-07-11 | Juniper Networks Contrail Service Orchestration releases prior to 4.0.0 have Grafana service enabled by default with hardcoded credentials. These credentials a… |
CVE-2018-0038 | Critical | 9.8 | 2018-07-11 | Juniper Networks Contrail Service Orchestration releases prior to 3.3.0 have Cassandra service enabled by default with hardcoded credentials. These credentials… |
CVE-2018-10633 | Critical | 9.8 | 2018-07-11 | Universal Robots Robot Controllers Version CB 3.1, SW Version 3.4.5-100 utilizes hard-coded credentials that may allow an attacker to reset passwords for the c… |
CVE-2018-11641 | Critical | 9.8 | 2018-07-03 | Use of Hard-coded Credentials in /var/www/xms/application/controllers/gatherLogs.php in the administrative console in Dialogic PowerMedia XMS through 3.5 allow… |
CVE-2018-11635 | Critical | 9.8 | 2018-07-03 | Use of a Hard-coded Cryptographic Key used to protect cookie session data in /var/www/xms/application/config/config.php in the administrative console in Dialog… |
CVE-2018-8870 | Medium | 6.4 | 2018-07-03 | Medtronic 24950 MyCareLink Monitor and 24952 MyCareLink Monitor contains a hard-coded operating system password. An attacker with physical access can remove th… |
CVE-2018-12924 | Critical | 9.8 | 2018-06-28 | Sollae Serial-Ethernet-Module and Remote-I/O-Device-Server devices have a default password of sollae for the TELNET service. |
CVE-2018-4846 | Critical | 9.8 | 2018-06-26 | A vulnerability has been identified in RAPIDLab 1200 systems / RAPIDPoint 400 systems / RAPIDPoint 500 systems (All versions_without_ use of Siemens Healthinee… |
CVE-2018-12526 | Critical | 9.8 | 2018-06-21 | Telesquare SDT-CS3B1 and SDT-CW3B1 devices through 1.2.0 have a default factory account. Remote attackers can obtain access to the device via TELNET using a ha… |
CVE-2018-6213 | Critical | 9.8 | 2018-06-20 | In the web server on D-Link DIR-620 devices with a certain customized (by ISP) variant of firmware 1.0.3, 1.0.37, 1.3.1, 1.3.3, 1.3.7, 1.4.0, and 2.0.22, there… |
CVE-2018-6210 | Critical | 9.8 | 2018-06-19 | D-Link DIR-620 devices, with a certain Rostelekom variant of firmware 1.0.37, have a hardcoded rostel account, which makes it easier for remote attackers to ob… |
CVE-2018-12323 | Medium | 6.8 | 2018-06-13 | An issue was discovered on Momentum Axel 720P 5.1.8 devices. A password of EHLGVG is hard-coded for the root and admin accounts, which makes it easier for phys… |
CVE-2018-0329 | Medium | 5.3 | 2018-06-07 | A vulnerability in the default configuration of the Simple Network Management Protocol (SNMP) feature of Cisco Wide Area Application Services (WAAS) Software c… |
CVE-2018-10966 | High | 7.3 | 2018-06-05 | An issue was discovered in GamerPolls 0.4.6, related to config/environments/all.js and config/initializers/02_passport.js. An attacker can edit the Passport.js… |
CVE-2018-10813 | High | 7.3 | 2018-06-05 | In Dedos-web 1.0, the cookie and session secrets used in the Express.js application have hardcoded values that are visible in the source code published on GitH… |
CVE-2018-11682 | Critical | 9.8 | 2018-06-02 | Default and unremovable support credentials allow attackers to gain total super user control of an IoT device through a TELNET session to products using the St… |
CVE-2018-11681 | Critical | 9.8 | 2018-06-02 | Default and unremovable support credentials (user:nwk password:nwk2) allow attackers to gain total super user control of an IoT device through a TELNET session… |
CVE-2018-11629 | Critical | 9.8 | 2018-06-02 | Default and unremovable support credentials (user:lutron password:integration) allow attackers to gain total super user control of an IoT device through a TELN… |
CVE-2018-11482 | Critical | 9.8 | 2018-05-30 | /usr/lib/lua/luci/websys.lua on TP-LINK IPC TL-IPC223(P)-6, TL-IPC323K-D, TL-IPC325(KP)-*, and TL-IPC40A-4 devices has a hardcoded zMiVw8Kw0oxKXL0 password. |
CVE-2018-11311 | Critical | 9.1 | 2018-05-20 | A hardcoded FTP username of myscada and password of Vikuk63 in 'myscadagate.exe' in mySCADA myPRO 7 allows remote attackers to access the FTP server on port 21… |
CVE-2018-0222 | Critical | 10.0 | 2018-05-17 | A vulnerability in Cisco Digital Network Architecture (DNA) Center could allow an unauthenticated, remote attacker to log in to an affected system by using an… |
CVE-2018-11094 | Critical | 9.8 | 2018-05-15 | An issue was discovered on Intelbras NCLOUD 300 1.0 devices. /cgi-bin/ExportSettings.sh, /goform/updateWPS, /goform/RebootSystem, and /goform/vpnBasicSettings… |
CVE-2018-9112 | Critical | 9.8 | 2018-05-10 | A low privileged admin account with a weak default password of admin exists on the Foxconn FEMTO AP-FC4064-T AP_GT_B38_5.8.3lb15-W47 LTE Build 15. In addition… |
CVE-2016-9335 | Critical | 10.0 | 2018-05-09 | A hard-coded cryptographic key vulnerability was identified in Red Lion Controls Sixnet-Managed Industrial Switches running firmware Version 5.0.196 and Stride… |
CVE-2017-17540 | Critical | 9.8 | 2018-05-08 | The presence of a hardcoded account in Fortinet FortiWLC 8.3.3 allows attackers to gain unauthorized read/write access via a remote shell. |
CVE-2017-17539 | Critical | 9.8 | 2018-05-08 | The presence of a hardcoded account in Fortinet FortiWLC 7.0.11 and earlier allows attackers to gain unauthorized read/write access via a remote shell. |
CVE-2018-10723 | Critical | 9.8 | 2018-05-05 | Directus 6.4.9 has a hardcoded admin password for the Admin account because of an INSERT statement in api/schema.sql. |
CVE-2018-8857 | High | 7.8 | 2018-05-04 | Philips Brilliance CT software (Brilliance 64 version 2.6.2 and prior, Brilliance iCT versions 4.1.6 and prior, Brillance iCT SP versions 3.2.4 and prior, and… |
CVE-2018-10167 | High | 7.5 | 2018-05-03 | The web application backup file in the TP-Link EAP Controller and Omada Controller versions 2.5.4_Windows/2.6.0_Windows is encrypted with a hard-coded cryptogr… |
CVE-2018-6401 | Critical | 9.8 | 2018-05-02 | Meross MSS110 devices before 1.1.24 contain a TELNET listener providing access for an undocumented admin account with a blank password. |
CVE-2017-14014 | Medium | 4.6 | 2018-05-01 | Boston Scientific ZOOM LATITUDE PRM Model 3120 uses a hard-coded cryptographic key to encrypt PHI prior to having it transferred to removable media. CVSS v3 ba… |
CVE-2018-10575 | Critical | 9.8 | 2018-04-30 | An issue was discovered on WatchGuard AP100, AP102, and AP200 devices with firmware before 1.2.9.15. Hardcoded credentials exist for an unprivileged SSH accoun… |
CVE-2017-9656 | Critical | 9.1 | 2018-04-24 | The backend database of the Philips DoseWise Portal application versions 1.1.7.333 and 2.1.1.3069 uses hard-coded credentials for a database account with privi… |
CVE-2018-10328 | High | 7.4 | 2018-04-24 | Momentum Axel 720P 5.1.8 devices have a hardcoded password of streaming for the appagent account, which allows remote attackers to view the RTSP video stream. |
CVE-2018-7241 | Critical | 9.8 | 2018-04-18 | Hard coded accounts exist in Schneider Electric's Modicon Premium, Modicon Quantum, Modicon M340, and BMXNOR0200 controllers in all versions of the communicati… |
CVE-2014-3413 | Critical | 9.8 | 2018-04-05 | The MySQL server in Juniper Networks Junos Space before 13.3R1.8 has an unspecified account with a hardcoded password, which allows remote attackers to obtain… |
CVE-2016-8717 | Critical | 9.8 | 2018-04-02 | An exploitable Use of Hard-coded Credentials vulnerability exists in the Moxa AWK-3131A Wireless Access Point running firmware 1.1. The device operating system… |
CVE-2018-9149 | Medium | 6.8 | 2018-04-01 | The Zyxel Multy X (AC3000 Tri-Band WiFi System) device doesn't use a suitable mechanism to protect the UART. After an attacker dismantles the device and uses a… |
CVE-2018-9161 | Critical | 9.8 | 2018-03-31 | Prisma Industriale Checkweigher PrismaWEB 1.21 allows remote attackers to discover the hardcoded prisma password for the prismaweb account by reading user/scri… |
CVE-2018-0150 | Critical | 9.8 | 2018-03-28 | A vulnerability in Cisco IOS XE Software could allow an unauthenticated, remote attacker to log in to a device running an affected release of Cisco IOS XE Soft… |
CVE-2018-5768 | Critical | 9.8 | 2018-03-20 | A remote, unauthenticated attacker can gain remote code execution on the the Tenda AC15 router with a specially crafted password parameter for the COOKIE heade… |
CVE-2017-14008 | Critical | 9.8 | 2018-03-20 | GE Centricity PACS RA1000, diagnostic image analysis, all current versions are affected these devices use default or hard-coded credentials. Successful exploit… |
CVE-2017-14006 | Critical | 9.8 | 2018-03-20 | GE Xeleris versions 1.0,1.1,2.1,3.0,3.1, medical imaging systems, all current versions are affected, these devices use default or hard-coded credentials. Succe… |
CVE-2017-14004 | Critical | 9.8 | 2018-03-20 | GE GEMNet License server (EchoServer) all current versions are affected these devices use default or hard-coded credentials. Successful exploitation of this vu… |
CVE-2017-14002 | Critical | 9.8 | 2018-03-20 | GE Infinia/Infinia with Hawkeye 4 medical imaging systems all current versions are affected these devices use default or hard-coded credentials. Successful exp… |
CVE-2018-5552 | Low | 2.9 | 2018-03-19 | Versions of DocuTrac QuicDoc and Office Therapy that ship with DTISQLInstaller.exe version 1.6.4.0 and prior contains a hard-coded cryptographic salt, "S@l+&pe… |
CVE-2018-5551 | Critical | 9.0 | 2018-03-19 | Versions of DocuTrac QuicDoc and Office Therapy that ship with DTISQLInstaller.exe version 1.6.4.0 and prior contain three credentials with known passwords: QD… |
CVE-2017-8013 | Critical | 9.8 | 2018-03-16 | EMC Data Protection Advisor 6.3.x before patch 67 and 6.4.x before patch 130 contains undocumented accounts with hard-coded passwords and various privileges. A… |