CWE-798 · Use of Hard-coded Credentials (page 7)
Page 7 of 18 — CVEs classified under CWE-798, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2023-6409 | High | 7.7 | 2024-02-14 | CWE-798: Use of Hard-coded Credentials vulnerability exists that could cause unauthorized access to a project file protected with application password when op… |
CVE-2024-23816 | Critical | 9.8 | 2024-02-13 | A vulnerability has been identified in Location Intelligence Perpetual Large (9DE5110-8CA13-1AX0) (All versions < V4.3), Location Intelligence Perpetual Medium… |
CVE-2024-22313 | Medium | 6.2 | 2024-02-10 | IBM Storage Defender - Resiliency Service 2.0 contains hard-coded credentials, such as a password or cryptographic key, which it uses for its own inbound authe… |
CVE-2023-38995 | Critical | 9.8 | 2024-02-07 | An issue in SCHUHFRIED v.8.22.00 allows remote attacker to obtain the database password via crafted curl command. |
CVE-2024-22853 | Critical | 9.8 | 2024-02-06 | D-LINK Go-RT-AC750 GORTAC750_A1_FW_v101b03 has a hardcoded password for the Alphanetworks account, which allows remote attackers to obtain root access via a te… |
CVE-2024-21764 | Critical | 9.8 | 2024-02-02 | In Rapid Software LLC's Rapid SCADA versions prior to Version 5.8.4, the product uses hard-coded credentials, which may allow an attacker to connect to a speci… |
CVE-2023-46706 | Critical | 9.1 | 2024-02-01 | Multiple MachineSense devices have credentials unable to be changed by the user or administrator. |
CVE-2024-1039 | Critical | 9.8 | 2024-02-01 | Gessler GmbH WEB-MASTER has a restoration account that uses weak hard coded credentials and if exploited could allow an attacker control over the web managemen… |
CVE-2024-24324 | Critical | 9.8 | 2024-01-30 | TOTOLINK A8000RU v7.1cu.643_B20200521 was discovered to contain a hardcoded password for root stored in /etc/shadow. |
CVE-2023-51840 | Critical | 9.8 | 2024-01-29 | DoraCMS 2.1.8 is vulnerable to Use of Hard-coded Cryptographic Key. |
CVE-2023-6482 | Medium | 5.2 | 2024-01-27 | Use of encryption key derived from static information in Synaptics Fingerprint Driver allows an attacker to set up a TLS session with the fingerprint sensor… |
CVE-2024-23619 | Critical | 9.8 | 2024-01-26 | A hardcoded credential vulnerability exists in IBM Merge Healthcare eFilm Workstation. A remote, unauthenticated attacker can exploit this vulnerability to ach… |
CVE-2024-23453 | Medium | 5.5 | 2024-01-24 | Android Spoon application version 7.11.1 to 8.6.0 uses hard-coded credentials, which may allow a local attacker to retrieve the hard-coded API key when the app… |
CVE-2024-23842 | High | 7.4 | 2024-01-23 | Improper Input Validation in Hitron Systems DVR LGUVR-16H 1.02~4.02 allows an attacker to cause network attack in case of using defalut admin ID/PW. |
CVE-2024-22772 | High | 7.4 | 2024-01-23 | Improper Input Validation in Hitron Systems DVR LGUVR-8H 1.02~4.02 allows an attacker to cause network attack in case of using defalut admin ID/PW. |
CVE-2024-22771 | High | 7.4 | 2024-01-23 | Improper Input Validation in Hitron Systems DVR LGUVR-4H 1.02~4.02 allows an attacker to cause network attack in case of using defalut admin ID/PW. |
CVE-2024-22770 | High | 7.4 | 2024-01-23 | Improper Input Validation in Hitron Systems DVR HVR-16781 1.03~4.02 allows an attacker to cause network attack in case of using defalut admin ID/PW. |
CVE-2024-22769 | High | 7.4 | 2024-01-23 | Improper Input Validation in Hitron Systems DVR HVR-8781 1.03~4.02 allows an attacker to cause network attack in case of using defalut admin ID/PW. |
CVE-2024-22768 | High | 7.4 | 2024-01-23 | Improper Input Validation in Hitron Systems DVR HVR-4781 1.03~4.02 allows an attacker to cause network attack in case of using defalut admin ID/PW. |
CVE-2024-23726 | High | 8.8 | 2024-01-21 | Ubee DDW365 XCNDDW365 devices have predictable default WPA2 PSKs that could lead to unauthorized remote access. A remote attacker (in proximity to a Wi-Fi netw… |
CVE-2024-23687 | Critical | 9.1 | 2024-01-19 | Hard-coded credentials in FOLIO mod-data-export-spring versions before 1.5.4 and from 2.0.0 to 2.0.2 allows unauthenticated users to access critical APIs, modi… |
CVE-2024-23685 | Medium | 5.3 | 2024-01-19 | Hard-coded credentials in mod-remote-storage versions under 1.7.2 and from 2.0.0 to 2.0.3 allows unauthorized users to gain read access to mod-inventory-storag… |
CVE-2023-46943 | Critical | 9.1 | 2024-01-13 | An issue was discovered in NPM's package @evershop/evershop before version 1.0.0-rc.8. The HMAC secret used for generating tokens is hardcoded as "secret". A w… |
CVE-2023-28897 | Medium | 4.0 | 2024-01-12 | The secret value used for access to critical UDS services of the MIB3 infotainment is hardcoded in the firmware. Vulnerability discovered on Škoda Superb III… |
CVE-2023-49256 | High | 7.5 | 2024-01-12 | It is possible to download the configuration backup without authorization and decrypt included passwords using hardcoded static key. |
CVE-2023-49253 | Critical | 9.8 | 2024-01-12 | Root user password is hardcoded into the device and cannot be changed in the user interface. |
CVE-2023-50124 | Medium | 6.8 | 2024-01-11 | Flient Smart Door Lock v1.0 is vulnerable to Use of Default Credentials. Due to default credentials on a debug interface, in combination with certain design ch… |
CVE-2023-48251 | High | 8.1 | 2024-01-10 | The vulnerability allows a remote attacker to authenticate to the SSH service with root privileges through a hidden hard-coded account. |
CVE-2023-48250 | High | 8.1 | 2024-01-10 | The vulnerability allows a remote attacker to authenticate to the web application with high privileges through multiple hidden hard-coded accounts. |
CVE-2023-50974 | Medium | 5.5 | 2024-01-09 | In Appwrite CLI before 3.0.0, when using the login command, the credentials of the Appwrite user are stored in a ~/.appwrite/prefs.json file with 0644 as UNIX… |
CVE-2023-50948 | Medium | 6.5 | 2024-01-08 | IBM Storage Fusion HCI 2.1.0 through 2.6.1 contains hard-coded credentials, such as a password or cryptographic key, which it uses for its own inbound authenti… |
CVE-2023-37608 | High | 7.5 | 2024-01-03 | An issue in Automatic Systems SOC FL9600 FirstLane V06 lego_T04E00 allows a remote attacker to obtain sensitive information because there is an automaticsystem… |
CVE-2023-49228 | Medium | 6.4 | 2023-12-28 | An issue was discovered in Peplink Balance Two before 8.4.0. Console port authentication uses hard-coded credentials, which allows an attacker with physical ac… |
CVE-2023-46918 | Medium | 4.6 | 2023-12-27 | Phlox com.phlox.simpleserver.plus (aka Simple HTTP Server PLUS) 1.8.1-plus has an Android manifest file that contains an entry with the android:allowBackup att… |
CVE-2023-46919 | Medium | 6.3 | 2023-12-27 | Phlox com.phlox.simpleserver (aka Simple HTTP Server) 1.8 and com.phlox.simpleserver.plus (aka Simple HTTP Server PLUS) 1.8.1-plus have a hardcoded aKySWb2jjrr… |
CVE-2023-46711 | Medium | 4.6 | 2023-12-26 | VR-S1000 firmware Ver. 2.37 and earlier uses a hard-coded cryptographic key which may allow an attacker to analyze the password of a specific product user. |
CVE-2023-40236 | Medium | 5.3 | 2023-12-25 | In Pexip VMR self-service portal before 3, the same SSH host key is used across different customers' installations, which allows authentication bypass. |
CVE-2023-47704 | Medium | 4.0 | 2023-12-20 | IBM Security Guardium Key Lifecycle Manager 4.3 contains plain text hard-coded credentials or other secrets in source code repository. IBM X-Force ID: 271220. |
CVE-2023-43870 | High | 8.1 | 2023-12-19 | When installing the Net2 software a root certificate is installed into the trusted store. A potential hacker could access the installer batch file or reverse e… |
CVE-2023-48392 | Critical | 9.8 | 2023-12-15 | Kaifa Technology WebITR is an online attendance system, it has a vulnerability in using hard-coded encryption key. An unauthenticated remote attacker can gener… |
CVE-2023-48388 | Critical | 9.8 | 2023-12-15 | Multisuns EasyLog web+ has a vulnerability of using hard-coded credentials. An remote attacker can exploit this vulnerability to access the system to perform a… |
CVE-2023-48374 | Medium | 6.5 | 2023-12-15 | SmartStar Software CWS is a web-base integration platform, it has a vulnerability of using a hard-coded for a specific account with low privilege. An unauthent… |
CVE-2023-43583 | Medium | 4.9 | 2023-12-13 | Cryptographic issues Zoom Mobile App for Android, Zoom Mobile App for iOS, and Zoom SDKs for Android and iOS before version 5.16.0 may allow a privileged user… |
CVE-2023-36651 | High | 7.2 | 2023-12-12 | Hidden and hard-coded credentials in ProLion CryptoSpike 3.0.15P2 allow remote attackers to login to web management as super-admin and consume the most privile… |
CVE-2023-36647 | High | 7.5 | 2023-12-12 | A hard-coded cryptographic private key used to sign JWT authentication tokens in ProLion CryptoSpike 3.0.15P2 allows remote attackers to impersonate arbitrary… |
CVE-2023-40300 | Critical | 9.8 | 2023-12-07 | NETSCOUT nGeniusPULSE 3.8 has a Hardcoded Cryptographic Key. |
CVE-2023-33413 | High | 8.8 | 2023-12-07 | The configuration functionality in the Intelligent Platform Management Interface (IPMI) baseboard management controller (BMC) implementation on Supermicro X11… |
CVE-2023-39169 | Critical | 9.8 | 2023-12-07 | The affected devices use publicly available default credentials with administrative privileges. |
CVE-2023-6448 | Critical | 9.8 | 2023-12-05 | Unitronics VisiLogic before version 9.9.00, used in Vision and Samba PLCs and HMIs, uses a default administrative password. An unauthenticated attacker with ne… |
CVE-2023-40464 | High | 8.1 | 2023-12-04 | Several versions of ALEOS, including ALEOS 4.16.0, use a hardcoded SSL certificate and private key. An attacker with access to these items coul… |
CVE-2023-40463 | High | 8.1 | 2023-12-04 | When configured in debugging mode by an authenticated user with administrative privileges, ALEOS 4.16 and earlier store the SHA512 hash of the… |
CVE-2023-28895 | Low | 3.5 | 2023-12-01 | The password for access to the debugging console of the PoWer Controller chip (PWC) of the MIB3 infotainment is hard-coded in the firmware. The console allows… |
CVE-2023-23324 | Critical | 9.8 | 2023-11-29 | Zumtobel Netlink CCD Onboard 3.74 - Firmware 3.80 was discovered to contain hardcoded credentials for the Administrator account. |
CVE-2023-29064 | Medium | 4.1 | 2023-11-28 | The FACSChorus software contains sensitive information stored in plaintext. A threat actor could gain hardcoded secrets used by the application, which include… |
CVE-2023-47315 | High | 8.8 | 2023-11-22 | Headwind MDM Web panel 5.22.1 is vulnerable to Incorrect Access Control due to a hard-coded JWT Secret. The secret is hardcoded into the source code available… |
CVE-2023-36013 | Medium | 6.5 | 2023-11-20 | PowerShell Information Disclosure Vulnerability |
CVE-2023-48055 | High | 7.5 | 2023-11-16 | SuperAGI v0.0.13 was discovered to use a hardcoded key for encryption operations. This vulnerability can lead to the disclosure of information and communicatio… |
CVE-2023-48053 | High | 7.5 | 2023-11-16 | Archery v1.10.0 uses a non-random or static IV for Cipher Block Chaining (CBC) mode in AES encryption. This vulnerability can lead to the disclosure of informa… |
CVE-2023-47213 | Critical | 9.8 | 2023-11-16 | First Corporation's DVRs use a hard-coded password, which may allow a remote unauthenticated attacker to rewrite or obtain the configuration information of the… |
CVE-2023-44296 | High | 8.4 | 2023-11-16 | Dell ELab-Navigator, version 3.1.9 contains a hard-coded credential vulnerability. A local attacker could potentially exploit this vulnerability, leading to u… |
CVE-2023-40719 | Medium | 4.1 | 2023-11-14 | A use of hard-coded credentials vulnerability in Fortinet FortiAnalyzer and FortiManager 7.0.0 - 7.0.8, 7.2.0 - 7.2.3 and 7.4.0 allows an attacker to access Fo… |
CVE-2023-33304 | Medium | 4.4 | 2023-11-14 | A use of hard-coded credentials vulnerability in Fortinet FortiClient Windows 7.0.0 - 7.0.9 and 7.2.0 - 7.2.1 allows an attacker to bypass system protections v… |
CVE-2023-47800 | Critical | 9.8 | 2023-11-10 | Natus NeuroWorks and SleepWorks before 8.4 GMA3 utilize a default password of xltek for the Microsoft SQL Server service sa account, allowing a threat actor to… |
CVE-2023-41137 | High | 8.0 | 2023-11-09 | Symmetric encryption used to protect messages between the AppsAnywhere server and client can be broken by reverse engineering the client and used to impersonat… |
CVE-2023-5777 | Critical | 9.8 | 2023-11-06 | Weintek EasyBuilder Pro contains a vulnerability that, even when the private key is immediately deleted after the crash report transmission is finished, the… |
CVE-2023-31579 | Critical | 9.8 | 2023-11-02 | Dromara Lamp-Cloud before v3.8.1 was discovered to use a hardcoded cryptographic key when creating and verifying a Json Web Token. This vulnerability allows at… |
CVE-2023-45499 | Critical | 9.8 | 2023-10-27 | VinChin Backup & Recovery v5.0.*, v6.0.*, v6.7.*, and v7.0.* was discovered to contain hardcoded credentials. |
CVE-2018-17558 | Critical | 9.8 | 2023-10-26 | Hardcoded manufacturer credentials and an OS command injection vulnerability in the /cgi-bin/mft/ directory on ABUS TVIP TVIP20050 LM.1.6.18, TVIP10051 LM.1.6… |
CVE-2023-46102 | High | 8.8 | 2023-10-25 | The Android Client application, when enrolled to the AppHub server, connects to an MQTT broker to exchange messages and receive commands to execute on the HMI… |
CVE-2023-42492 | High | 7.1 | 2023-10-25 | EisBaer Scada - CWE-321: Use of Hard-coded Cryptographic Key |
CVE-2023-41372 | High | 7.8 | 2023-10-25 | The vulnerability allows an unprivileged (untrusted) third- party application to arbitrary modify the server settings of the Android Client application, induci… |
CVE-2023-31581 | Critical | 9.8 | 2023-10-25 | Dromara Sureness before v1.0.8 was discovered to use a hardcoded key. |
CVE-2023-26219 | High | 7.4 | 2023-10-25 | The Hawk Console and Hawk Agent components of TIBCO Software Inc.'s TIBCO Hawk, TIBCO Hawk Distribution for TIBCO Silver Fabric, TIBCO Operational Intelligence… |
CVE-2022-22466 | Medium | 6.8 | 2023-10-23 | IBM Security Verify Governance 10.0 contains hard-coded credentials, such as a password or cryptographic key, which it uses for its own inbound authentication… |
CVE-2023-41713 | High | 7.5 | 2023-10-17 | SonicOS Use of Hard-coded Password vulnerability in the 'dynHandleBuyToolbar' demo function. |
CVE-2023-33836 | Medium | 5.3 | 2023-10-16 | IBM Security Verify Governance 10.0 contains hard-coded credentials, such as a password or cryptographic key, which it uses for its own inbound authentication… |
CVE-2023-45194 | Medium | 4.3 | 2023-10-11 | Use of default credentials vulnerability in MR-GM2 firmware Ver. 3.00.03 and earlier, and MR-GM3 (-D/-K/-S/-DK/-DKS/-M/-W) firmware Ver. 1.03.45 and earlier al… |
CVE-2023-30801 | Critical | 9.8 | 2023-10-10 | All versions of the qBittorrent client through 4.5.5 use default credentials when the web user interface is enabled. The administrator is not forced to change… |
CVE-2023-45226 | High | 7.4 | 2023-10-10 | The BIG-IP SPK TMM (Traffic Management Module) f5-debug-sidecar and f5-debug-sshd containers contains hardcoded credentials that may allow an attacker with th… |
CVE-2023-36380 | Critical | 9.8 | 2023-10-10 | A vulnerability has been identified in CP-8031 MASTER MODULE (All versions < CPCI85 V05.11 (only with activated debug support)), CP-8050 MASTER MODULE (All ver… |
CVE-2023-2306 | Critical | 10.0 | 2023-10-05 | Qognify NiceVision versions 3.1 and prior are vulnerable to exposing sensitive information using hard-coded credentials. With these credentials an attacke… |
CVE-2023-20101 | Critical | 9.8 | 2023-10-04 | A vulnerability in Cisco Emergency Responder could allow an unauthenticated, remote attacker to log in to an affected device using the root account, which has… |
CVE-2022-47891 | High | 8.1 | 2023-10-03 | All versions of NetMan 204 allow an attacker that knows the MAC and serial number of the device to reset the administrator password via the legitimate recovery… |
CVE-2023-5318 | High | 7.5 | 2023-09-30 | Use of Hard-coded Credentials in GitHub repository microweber/microweber prior to 2.0. |
CVE-2023-20034 | High | 7.5 | 2023-09-27 | Vulnerability in the Elasticsearch database used in the of Cisco SD-WAN vManage software could allow an unauthenticated, remote attacker to access the Elastics… |
CVE-2023-41878 | Medium | 4.6 | 2023-09-27 | MeterSphere is a one-stop open source continuous testing platform, covering functions such as test tracking, interface testing, UI testing and performance test… |
CVE-2023-43637 | High | 7.8 | 2023-09-21 | Due to the implementation of "deriveVaultKey", prior to version 7.10, the generated vault key would always have the last 16 bytes predetermined to be "arfooba… |
CVE-2023-5074 | Critical | 9.8 | 2023-09-20 | Use of a static key to protect a JWT token used in user authentication can allow an for an authentication bypass in D-Link D-View 8 v2.0.1.28 |
CVE-2023-31808 | High | 7.2 | 2023-09-19 | Technicolor TG670 10.5.N.9 devices contain multiple accounts with hard-coded passwords. One account has administrative privileges, allowing for unrestricted ac… |
CVE-2022-47558 | Critical | 9.4 | 2023-09-19 | Devices ekorCCP and ekorRCI are vulnerable due to access to the FTP service using default credentials. Exploitation of this vulnerability can allow an attacker… |
CVE-2023-41030 | Medium | 6.3 | 2023-09-18 | Hard-coded credentials in Juplink RX4-1500 versions V1.0.2 through V1.0.5 allow unauthenticated attackers to log in to the web interface or telnet service as t… |
CVE-2023-42328 | High | 8.8 | 2023-09-18 | An issue in PeppermintLabs Peppermint v.0.2.4 and before allows a remote attacker to obtain sensitive information and execute arbitrary code via the hardcoded… |
CVE-2023-41595 | High | 7.5 | 2023-09-18 | An issue in xui-xray v1.8.3 allows attackers to obtain sensitive information via default password. |
CVE-2023-42336 | Critical | 9.8 | 2023-09-16 | An issue in NETIS SYSTEMS WF2409Ev4 v.1.0.1.705 allows a remote attacker to execute arbitrary code and obtain sensitive information via the password parameter… |
CVE-2023-37755 | Critical | 9.8 | 2023-09-14 | i-doit pro 25 and below and I-doit open 25 and below are configured with insecure default administrator credentials, and there is no warning or prompt to ask u… |
CVE-2023-40717 | Medium | 5.3 | 2023-09-13 | A use of hard-coded credentials vulnerability [CWE-798] in FortiTester 2.3.0 through 7.2.3 may allow an attacker who managed to get a shell on the device to ac… |
CVE-2023-27169 | Medium | 6.5 | 2023-09-12 | Xpand IT Write-back manager v2.3.1 uses a hardcoded salt in license class configuration which leads to the generation of a hardcoded and predictable symmetric… |
CVE-2023-39422 | Medium | 6.5 | 2023-09-07 | The /irmdata/api/ endpoints exposed by the IRM Next Generation booking engine authenticates requests using HMAC tokens. These tokens are however exposed in a J… |
CVE-2023-39421 | High | 7.7 | 2023-09-07 | The RDPWin.dll component as used in the IRM Next Generation booking engine includes a set of hardcoded API keys for third-party services such as Twilio and Von… |
CVE-2023-39420 | Critical | 9.9 | 2023-09-07 | The RDPCore.dll component as used in the IRM Next Generation booking engine, allows a remote user to connect to customers with an "admin" account and a corresp… |