CWE-798 · Use of Hard-coded Credentials (page 7)
Page 7 of 19 — CVEs classified under CWE-798, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2023-41919 | Critical | 9.8 | 2024-07-02 | Hardcoded credentials are discovered within the application's source code, creating a potential security risk for unauthorized access. |
CVE-2024-38480 | Medium | 4.0 | 2024-07-01 | "Piccoma" App for Android and iOS versions prior to 6.20.0 uses a hard-coded API key for an external service, which may allow a local attacker to obtain the AP… |
CVE-2024-39208 | Critical | 9.8 | 2024-06-27 | luci-app-lucky v2.8.3 was discovered to contain hardcoded credentials. |
CVE-2024-39374 | Critical | 9.8 | 2024-06-27 | TELSAT marKoni FM Transmitters are vulnerable to an attacker exploiting a hidden admin account that can be accessed through the use of hard-coded credentials. |
CVE-2024-0949 | Critical | 9.8 | 2024-06-27 | Missing Authentication, Files or Directories Accessible to External Parties, Use of Hard-coded Credentials vulnerability in Talya Informatics Elektraweb allows… |
CVE-2024-33329 | High | 7.5 | 2024-06-26 | A hardcoded privileged ID within Lumisxp v15.0.x to v16.1.x allows attackers to bypass authentication and access internal pages and other sensitive information. |
CVE-2024-5460 | High | 8.1 | 2024-06-26 | A vulnerability in the default configuration of the Simple Network Management Protocol (SNMP) feature of Brocade Fabric OS versions before v9.0.0 could allow… |
CVE-2023-6198 | Critical | 9.3 | 2024-06-25 | Use of Hard-coded Credentials vulnerability in Baicells Snap Router BaiCE_BMI on EP3011 (User Passwords modules) allows unauthorized access to the device. |
CVE-2024-36496 | High | 7.5 | 2024-06-24 | The configuration file is encrypted with a static key derived from a static five-character password which allows an attacker to decrypt this file. The applic… |
CVE-2024-36480 | Critical | 9.8 | 2024-06-19 | Use of hard-coded credentials issue exists in Ricoh Streamline NX PC Client ver.3.7.2 and earlier. If this vulnerability is exploited, an attacker may obtain L… |
CVE-2024-6045 | High | 8.8 | 2024-06-17 | Certain models of D-Link wireless routers contain an undisclosed factory testing backdoor. Unauthenticated attackers on the local area network can force the de… |
CVE-2024-38466 | Critical | 9.8 | 2024-06-16 | Shenzhen Guoxin Synthesis image system before 8.3.0 has a 123456Qw default password. |
CVE-2024-27170 | High | 7.4 | 2024-06-14 | It was observed that all the Toshiba printers contain credentials used for WebDAV access in the readable file. Then, it is possible to get a full access with W… |
CVE-2024-27168 | High | 7.1 | 2024-06-14 | It appears that some hardcoded keys are used for authentication to internal API. Knowing these private keys may allow attackers to bypass authentication and re… |
CVE-2024-27161 | Medium | 6.2 | 2024-06-14 | all the Toshiba printers have programs containing a hardcoded key used to encrypt files. An attacker can decrypt the encrypted files using the hardcoded key. I… |
CVE-2024-27160 | Medium | 6.2 | 2024-06-14 | All the Toshiba printers contain a shell script using the same hardcoded key to encrypt logs. An attacker can decrypt the encrypted files using the hardcoded k… |
CVE-2024-27159 | Medium | 6.2 | 2024-06-14 | All the Toshiba printers contain a shell script using the same hardcoded key to encrypt logs. An attacker can decrypt the encrypted files using the hardcoded k… |
CVE-2024-37630 | High | 8.8 | 2024-06-13 | D-Link DIR-605L v2.13B01 was discovered to contain a hardcoded password vulnerability in /etc/passwd, which allows attackers to log in as root. |
CVE-2024-38281 | Critical | 9.8 | 2024-06-13 | An attacker can access the maintenance console using hard coded credentials for a hidden wireless network on the device. |
CVE-2024-0865 | High | 7.8 | 2024-06-12 | CWE-798: Use of hard-coded credentials vulnerability exists that could cause local privilege escalation when logged in as a non-administrative user. |
CVE-2024-29855 | Critical | 9.0 | 2024-06-11 | Hard-coded JWT secret allows authentication bypass in Veeam Recovery Orchestrator |
CVE-2024-3700 | Critical | 9.8 | 2024-06-10 | Use of hard-coded password to the patients' database allows an attacker to retrieve sensitive data stored in the database. The password is the same among all S… |
CVE-2024-3699 | Critical | 9.8 | 2024-06-10 | Use of hard-coded password to the patients' database allows an attacker to retrieve sensitive data stored in the database. The password is the same among all d… |
CVE-2024-1228 | Critical | 9.8 | 2024-06-10 | Use of hard-coded password to the patients' database allows an attacker to retrieve sensitive data stored in the database. The password is the same among all E… |
CVE-2023-49224 | High | 8.0 | 2024-06-07 | Precor touchscreen console P62, P80, and P82 contains a default SSH public key in the authorized_keys file. A remote attacker could use this key to gain root p… |
CVE-2023-49223 | High | 8.8 | 2024-06-07 | Precor touchscreen console P62, P80, and P82 could allow a remote attacker to obtain sensitive information because the root password is stored in /etc/passwd… |
CVE-2023-49222 | High | 8.8 | 2024-06-07 | Precor touchscreen console P82 contains a private SSH key that corresponds to a default public key. A remote attacker could exploit this to gain root privilege… |
CVE-2023-49221 | High | 7.8 | 2024-06-07 | Precor touchscreen console P62, P80, and P82 could allow a remote attacker (within the local network) to bypass security restrictions, and access the service m… |
CVE-2024-3408 | Critical | 9.8 | 2024-06-06 | man-group/dtale version 3.10.0 is vulnerable to an authentication bypass and remote code execution (RCE) due to improper input validation. The vulnerability ar… |
CVE-2024-29170 | High | 8.1 | 2024-06-04 | Dell PowerScale OneFS versions 8.2.x through 9.8.0.x contain a use of hard coded credentials vulnerability. An adjacent network unauthenticated attacker could… |
CVE-2024-36782 | Critical | 9.8 | 2024-06-03 | TOTOLINK CP300 V2.0.4-B20201102 was discovered to contain a hardcoded password vulnerability in /etc/shadow.sample, which allows attackers to log in as root. |
CVE-2024-5514 | Critical | 9.8 | 2024-05-30 | MinMax CMS from MinMax Digital Technology contains a hidden administrator account with a fixed password that cannot be removed or disabled from the management… |
CVE-2024-36049 | Medium | 6.5 | 2024-05-24 | Aptos Wisal payroll accounting before 7.1.6 uses hardcoded credentials in the Windows client to fetch the complete list of usernames and passwords from the dat… |
CVE-2024-35396 | Critical | 9.8 | 2024-05-24 | TOTOLINK CP900L v4.1.5cu.798_B20221228 was discovered to contain a hardcoded password for telnet in /web_cste/cgi-bin/product.ini, which allows attackers to lo… |
CVE-2024-32988 | High | 7.5 | 2024-05-22 | 'OfferBox' App for Android versions 2.0.0 to 2.3.17 and 'OfferBox' App for iOS versions 2.1.7 to 2.6.14 use a hard-coded secret key for JWT. Secret key for JWT… |
CVE-2024-4844 | High | 7.5 | 2024-05-16 | Hardcoded credentials vulnerability in Trellix ePolicy Orchestrator (ePO) on Premise prior to 5.10 Service Pack 1 Update 2 allows an attacker with admin privil… |
CVE-2024-32053 | Critical | 9.8 | 2024-05-15 | Hard-coded credentials are used by the CyberPower PowerPanel platform to authenticate to the database, other services, and the cloud. This could result in… |
CVE-2024-27107 | Critical | 9.6 | 2024-05-14 | Weak account password in GE HealthCare EchoPAC products |
CVE-2024-32740 | Critical | 9.8 | 2024-05-14 | A vulnerability has been identified in SIMATIC CN 4100 (All versions < V3.0). The affected device contains undocumented users and credentials. An attacker coul… |
CVE-2024-34219 | High | 8.6 | 2024-05-14 | TOTOLINK CP450 V4.1.0cu.747_B20191224 was discovered to contain a vulnerability in the SetTelnetCfg function, which allows attackers to log in through telnet. |
CVE-2024-31810 | Critical | 9.8 | 2024-05-14 | TOTOLINK EX200 V4.0.3c.7646_B20201211 was discovered to contain a hardcoded password for root at /etc/shadow.sample. |
CVE-2024-23473 | High | 8.6 | 2024-05-14 | The SolarWinds Access Rights Manager was found to contain a hard-coded credential authentication bypass vulnerability. If exploited, this vulnerability allows… |
CVE-2023-26566 | High | 8.6 | 2024-05-14 | Sangoma FreePBX 1805 through 2203 on Linux contains hardcoded credentials for the Asterisk REST Interface (ARI), which allows remote attackers to reconfigure A… |
CVE-2023-51629 | High | 8.8 | 2024-05-03 | D-Link DCS-8300LHV2 ONVIF Hardcoded PIN Authentication Bypass Vulnerability. This vulnerability allows network-adjacent attackers to bypass authentication on a… |
CVE-2023-51588 | High | 7.8 | 2024-05-03 | Voltronic Power ViewPower Pro MySQL Use of Hard-coded Credentials Local Privilege Escalation Vulnerability. This vulnerability allows local attackers to escala… |
CVE-2023-44411 | Critical | 9.8 | 2024-05-03 | D-Link D-View InstallApplication Use of Hard-coded Credentials Authentication Bypass Vulnerability. This vulnerability allows remote attackers to bypass authen… |
CVE-2023-39482 | Medium | 6.5 | 2024-05-03 | Softing Secure Integration Server Hardcoded Cryptographic Key Information Disclosure Vulnerability. This vulnerability allows remote attackers to disclose sens… |
CVE-2023-39458 | Medium | 5.3 | 2024-05-03 | Triangle MicroWorks SCADA Data Gateway Use of Hard-coded Credentials Authentication Bypass Vulnerability. This vulnerability allows network-adjacent attackers… |
CVE-2023-35724 | High | 8.8 | 2024-05-03 | D-Link DAP-2622 Telnet CLI Use of Hardcoded Credentials Authentication Bypass Vulnerability. This vulnerability allows network-adjacent attackers to bypass aut… |
CVE-2023-34284 | Medium | 6.3 | 2024-05-03 | NETGEAR RAX30 Use of Hard-coded Credentials Authentication Bypass Vulnerability. This vulnerability allows network-adjacent attackers to bypass authentication… |
CVE-2023-32145 | High | 8.8 | 2024-05-03 | D-Link DAP-1360 Hardcoded Credentials Authentication Bypass Vulnerability. This vulnerability allows network-adjacent attackers to bypass authentication on aff… |
CVE-2024-3544 | High | 7.5 | 2024-05-02 | Unauthenticated attackers can perform actions, using SSH private keys, by knowing the IP address and having access to the same network of one of the machines… |
CVE-2023-52723 | High | 7.1 | 2024-04-29 | In KDE libksieve before 23.03.80, kmanagesieve/session.cpp places a cleartext password in server logs because a username variable is accidentally given a passw… |
CVE-2024-22813 | Medium | 4.4 | 2024-04-22 | An issue in Tormach xsTECH CNC Router, PathPilot Controller v2.9.6 allows attackers to overwrite the hardcoded IP address in the device memory, disrupting netw… |
CVE-2024-29966 | High | 7.5 | 2024-04-19 | Brocade SANnav OVA before v2.3.1 and v2.3.0a contain hard-coded credentials in the documentation that appear as the appliance's root password. The vulnerabilit… |
CVE-2024-29963 | Low | 1.9 | 2024-04-19 | Brocade SANnav OVA before v2.3.1, and v2.3.0a, contain hardcoded TLS keys used by Docker. Note: Brocade SANnav doesn't have access to remote Docker registries… |
CVE-2024-29960 | Medium | 6.8 | 2024-04-19 | In Brocade SANnav server before v2.3.1 and v2.3.0a, the SSH keys inside the OVA image are identical in the VM every time SANnav is installed. Any Brocade SAnn… |
CVE-2024-21990 | Medium | 5.4 | 2024-04-17 | ONTAP Select Deploy administration utility versions 9.12.1.x, 9.13.1.x and 9.14.1.x contain hard-coded credentials that could allow an attacker to view Deplo… |
CVE-2023-40146 | Medium | 6.8 | 2024-04-17 | A privilege escalation vulnerability exists in the /bin/login functionality of Peplink Smart Reader v1.2.0 (in QEMU). A specially crafted command line argument… |
CVE-2024-31873 | High | 7.5 | 2024-04-10 | IBM Security Verify Access Appliance 10.0.0 through 10.0.7 contains hard-coded credentials which it uses for its own inbound authentication that could be obtai… |
CVE-2024-29063 | High | 7.3 | 2024-04-09 | Azure AI Search Information Disclosure Vulnerability |
CVE-2024-3272 | Critical | 9.8 | 2024-04-04 | ** UNSUPPORTED WHEN ASSIGNED ** A vulnerability, which was classified as very critical, has been found in D-Link DNS-320L, DNS-325, DNS-327L and DNS-340L up to… |
CVE-2024-3130 | Medium | 5.7 | 2024-04-01 | Hard-coded Credentials in CoolKit eWeLlink app are before 5.4.x on Android and IOS allows local attacker to unauthorized access to sensitive data via Decryptio… |
CVE-2024-2161 | Critical | 9.8 | 2024-03-21 | Use of Hard-coded Credentials in Kiloview NDI allows un-authenticated users to bypass authenticationThis issue affects Kiloview NDI N3, N3-s, N4, N20, N30, N40… |
CVE-2024-22083 | Medium | 6.5 | 2024-03-20 | An issue was discovered in Elspec G5 digital fault recorder versions 1.1.4.15 and before. A hardcoded backdoor session ID exists that can be used for further a… |
CVE-2024-27774 | High | 7.5 | 2024-03-18 | Unitronics Unistream Unilogic – Versions prior to 1.35.227 - CWE-259: Use of Hard-coded Password may allow disclosing Sensitive Information Embedded inside D… |
CVE-2023-38535 | Medium | 4.7 | 2024-03-13 | Use of Hard-coded Cryptographic Key vulnerability in OpenText™ Exceed Turbo X affecting versions 12.5.1 and 12.5.2. The vulnerability could compromise the cryp… |
CVE-2024-28194 | Critical | 9.1 | 2024-03-13 | your_spotify is an open source, self hosted Spotify tracking dashboard. YourSpotify versions < 1.8.0 use a hardcoded JSON Web Token (JWT) secret to sign authen… |
CVE-2023-5456 | High | 8.1 | 2024-03-05 | A CWE-798 “Use of Hard-coded Credentials” vulnerability in the MariaDB database of the web application allows a remote unauthenticated attacker to access the d… |
CVE-2024-25731 | High | 7.5 | 2024-03-05 | The Elink Smart eSmartCam (com.cn.dq.ipc) application 2.1.5 for Android contains hardcoded AES encryption keys that can be extracted from a binary file. Thus… |
CVE-2024-24681 | Critical | 9.8 | 2024-02-23 | An issue was discovered in Yealink Configuration Encrypt Tool (AES version) and Yealink Configuration Encrypt Tool (RSA version before 1.2). There is a single… |
CVE-2024-1661 | Low | 2.5 | 2024-02-20 | A vulnerability classified as problematic was found in Totolink X6000R 9.4.0cu.852_B20230719. Affected by this vulnerability is an unknown functionality of the… |
CVE-2024-1344 | Medium | 6.8 | 2024-02-19 | Encrypted database credentials in LaborOfficeFree affecting version 19.10. This vulnerability allows an attacker to read and extract the username and password… |
CVE-2023-6255 | High | 7.5 | 2024-02-15 | Use of Hard-coded Credentials vulnerability in Utarit Information Technologies SoliPay Mobile App allows Read Sensitive Strings Within an Executable. This iss… |
CVE-2024-0390 | Critical | 9.8 | 2024-02-15 | INPRAX "iZZi connect" application on Android contains hard-coded MQTT queue credentials. The same MQTT queue is used by corresponding physical recuperation dev… |
CVE-2023-4539 | High | 7.5 | 2024-02-15 | Use of a hard-coded password for a special database account created during Comarch ERP XL installation allows an attacker to retrieve embedded sensitive data s… |
CVE-2023-6409 | High | 7.7 | 2024-02-14 | CWE-798: Use of Hard-coded Credentials vulnerability exists that could cause unauthorized access to a project file protected with application password when op… |
CVE-2024-23816 | Critical | 9.8 | 2024-02-13 | A vulnerability has been identified in Location Intelligence Perpetual Large (9DE5110-8CA13-1AX0) (All versions < V4.3), Location Intelligence Perpetual Medium… |
CVE-2024-22313 | Medium | 6.2 | 2024-02-10 | IBM Storage Defender - Resiliency Service 2.0 contains hard-coded credentials, such as a password or cryptographic key, which it uses for its own inbound authe… |
CVE-2023-38995 | Critical | 9.8 | 2024-02-07 | An issue in SCHUHFRIED v.8.22.00 allows remote attacker to obtain the database password via crafted curl command. |
CVE-2024-22853 | Critical | 9.8 | 2024-02-06 | D-LINK Go-RT-AC750 GORTAC750_A1_FW_v101b03 has a hardcoded password for the Alphanetworks account, which allows remote attackers to obtain root access via a te… |
CVE-2024-21764 | Critical | 9.8 | 2024-02-02 | In Rapid Software LLC's Rapid SCADA versions prior to Version 5.8.4, the product uses hard-coded credentials, which may allow an attacker to connect to a speci… |
CVE-2023-46706 | Critical | 9.1 | 2024-02-01 | Multiple MachineSense devices have credentials unable to be changed by the user or administrator. |
CVE-2024-1039 | Critical | 9.8 | 2024-02-01 | Gessler GmbH WEB-MASTER has a restoration account that uses weak hard coded credentials and if exploited could allow an attacker control over the web managemen… |
CVE-2024-24324 | Critical | 9.8 | 2024-01-30 | TOTOLINK A8000RU v7.1cu.643_B20200521 was discovered to contain a hardcoded password for root stored in /etc/shadow. |
CVE-2023-51840 | Critical | 9.8 | 2024-01-29 | DoraCMS 2.1.8 is vulnerable to Use of Hard-coded Cryptographic Key. |
CVE-2023-6482 | Medium | 5.2 | 2024-01-27 | Use of encryption key derived from static information in Synaptics Fingerprint Driver allows an attacker to set up a TLS session with the fingerprint sensor… |
CVE-2024-23619 | Critical | 9.8 | 2024-01-26 | A hardcoded credential vulnerability exists in IBM Merge Healthcare eFilm Workstation. A remote, unauthenticated attacker can exploit this vulnerability to ach… |
CVE-2024-23453 | Medium | 5.5 | 2024-01-24 | Android Spoon application version 7.11.1 to 8.6.0 uses hard-coded credentials, which may allow a local attacker to retrieve the hard-coded API key when the app… |
CVE-2024-23842 | High | 7.4 | 2024-01-23 | Improper Input Validation in Hitron Systems DVR LGUVR-16H 1.02~4.02 allows an attacker to cause network attack in case of using defalut admin ID/PW. |
CVE-2024-22772 | High | 7.4 | 2024-01-23 | Improper Input Validation in Hitron Systems DVR LGUVR-8H 1.02~4.02 allows an attacker to cause network attack in case of using defalut admin ID/PW. |
CVE-2024-22771 | High | 7.4 | 2024-01-23 | Improper Input Validation in Hitron Systems DVR LGUVR-4H 1.02~4.02 allows an attacker to cause network attack in case of using defalut admin ID/PW. |
CVE-2024-22770 | High | 7.4 | 2024-01-23 | Improper Input Validation in Hitron Systems DVR HVR-16781 1.03~4.02 allows an attacker to cause network attack in case of using defalut admin ID/PW. |
CVE-2024-22769 | High | 7.4 | 2024-01-23 | Improper Input Validation in Hitron Systems DVR HVR-8781 1.03~4.02 allows an attacker to cause network attack in case of using defalut admin ID/PW. |
CVE-2024-22768 | High | 7.4 | 2024-01-23 | Improper Input Validation in Hitron Systems DVR HVR-4781 1.03~4.02 allows an attacker to cause network attack in case of using defalut admin ID/PW. |
CVE-2024-23726 | High | 8.8 | 2024-01-21 | Ubee DDW365 XCNDDW365 devices have predictable default WPA2 PSKs that could lead to unauthorized remote access. A remote attacker (in proximity to a Wi-Fi netw… |
CVE-2024-23687 | Critical | 9.1 | 2024-01-19 | Hard-coded credentials in FOLIO mod-data-export-spring versions before 1.5.4 and from 2.0.0 to 2.0.2 allows unauthenticated users to access critical APIs, modi… |
CVE-2024-23685 | Medium | 5.3 | 2024-01-19 | Hard-coded credentials in mod-remote-storage versions under 1.7.2 and from 2.0.0 to 2.0.3 allows unauthorized users to gain read access to mod-inventory-storag… |
CVE-2023-46943 | Critical | 9.1 | 2024-01-13 | An issue was discovered in NPM's package @evershop/evershop before version 1.0.0-rc.8. The HMAC secret used for generating tokens is hardcoded as "secret". A w… |
CVE-2023-28897 | Medium | 4.0 | 2024-01-12 | The secret value used for access to critical UDS services of the MIB3 infotainment is hardcoded in the firmware. Vulnerability discovered on Škoda Superb III… |