# Hard-coded credentials. Passwords and keys built into the code, or weak credentials. Every Advisory and CVE whose weakness (CWE) is one of these, newest first. ## Records, newest first (an older page) - [IBM CICS Transaction Gateway for Multiplatforms information disclosure](https://agentprime.io/advisories/CVE-2023-50311.md) `CVE-2023-50311` · CVE record: IBM CICS Transaction Gateway for Multiplatforms · CVSS 3.1 Low · Not analysed yet · Published 31 Mar 2024 · Tags: Hard-coded credentials - [Hard-coded password in NEC Corporation WG1800HP4 and others](https://agentprime.io/advisories/CVE-2024-28010.md) `CVE-2024-28010` · CVE record: NEC Corporation WG1800HP4 and 4 more · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 28 Mar 2024 · Tags: Hard-coded credentials - [Insufficiently protected credentials in Sangoma Technologies cg6kwin2k.sys](https://agentprime.io/advisories/CVE-2024-29216.md) `CVE-2024-29216` · CVE record: Sangoma Technologies cg6kwin2k.sys · CVSS 6.1 Medium · Not analysed yet · Published 25 Mar 2024 · Tags: Hard-coded credentials - [Weak credentials in KDDI CORPORATION HGW BL1500HM](https://agentprime.io/advisories/CVE-2024-21865.md) `CVE-2024-21865` · CVE record: KDDI CORPORATION HGW BL1500HM · CVSS 6.5 Medium · Not analysed yet · Published 25 Mar 2024 · Tags: Hard-coded credentials - [Weak credentials in KDDI CORPORATION HGW BL1500HM](https://agentprime.io/advisories/CVE-2024-29071.md) `CVE-2024-29071` · CVE record: KDDI CORPORATION HGW BL1500HM · CVSS 8.8 High · Not analysed yet · Published 25 Mar 2024 · Tags: Hard-coded credentials - [Use of Hard-coded Credentials in Kiloview NDI N series products API middleware](https://agentprime.io/advisories/CVE-2024-2161.md) `CVE-2024-2161` · CVE record: Kiloview NDI · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 21 Mar 2024 · Tags: Hard-coded credentials - [Chirp Systems Chirp Access Use of Hard-coded Password](https://agentprime.io/advisories/CVE-2024-2197.md) `CVE-2024-2197` · CVE record: Chirp Systems Chirp Access · CVSS 2.3 Low · Not analysed yet · Published 19 Mar 2024 · Tags: Hard-coded credentials - [Unitronics Unistream Unilogic – Versions prior to 1.35.227 CWE-259: Use of Hard-coded Password](https://agentprime.io/advisories/CVE-2024-27774.md) `CVE-2024-27774` · CVE record: Unitronics Unistream Unilogic · CVSS 7.5 High · Not analysed yet · Published 18 Mar 2024 · Tags: Hard-coded credentials - [IBM Host Access Transformation Services information disclosure](https://agentprime.io/advisories/CVE-2021-38938.md) `CVE-2021-38938` · CVE record: IBM Host Access Transformation Services · CVSS 6.2 Medium · Not analysed yet · Published 15 Mar 2024 · Tags: Hard-coded credentials - [Hard-coded cryptographic key in OpenText™ Exceed Turbo X](https://agentprime.io/advisories/CVE-2023-38535.md) `CVE-2023-38535` · CVE record: OpenText™ Exceed Turbo X · CVSS 4.7 Medium · Not analysed yet · Published 13 Mar 2024 · Tags: Hard-coded credentials - [Authentication Bypass Because of Hardcoded JWT Secret in your_spotify](https://agentprime.io/advisories/CVE-2024-28194.md) `CVE-2024-28194` · CVE record: Yooooomi your_spotify · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 13 Mar 2024 · Tags: Hard-coded credentials - [Hustle <= 7.8.3 - Sensitive Information Exposure via Exposed Hubspot API Keys](https://agentprime.io/advisories/CVE-2024-0368.md) `CVE-2024-0368` · CVE record: wpmudev Hustle – Email Marketing, Lead Generation, Optins, Popups · CVSS 8.6 High · Not analysed yet · Published 13 Mar 2024 · Tags: Hard-coded credentials - [Intumit SmartRobot - Use of Hard-coded Cryptographic Key](https://agentprime.io/advisories/CVE-2024-2413.md) `CVE-2024-2413` · CVE record: Intumit SmartRobot · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 13 Mar 2024 · Tags: Hard-coded credentials - [Arris SBG6580 devices have predictable default WPA2 security passwords that could lead to unauthorized remote access.](https://agentprime.io/advisories/CVE-2024-25729.md) `CVE-2024-25729` · CVE record · CVSS 8.8 High · Not analysed yet · Published 7 Mar 2024 · Tags: Hard-coded credentials - [Go SDK for CloudEvents's use of WithRoundTripper to create a Client leaks credentials](https://agentprime.io/advisories/GHSA-5pf6-2qwx-pxm2.md) `GHSA-5pf6-2qwx-pxm2`, `CVE-2024-28110`, `GO-2024-2618` · Go `github.com/cloudevents/sdk-go/v2`: affected `<2.15.2`, fixed in `2.15.2` · CVSS 7.5 High · Not analysed yet · Published 6 Mar 2024 · Tags: Hard-coded credentials - [Hard-coded credentials in AiLux imx6 bundle](https://agentprime.io/advisories/CVE-2023-5456.md) `CVE-2023-5456` · CVE record: AiLux imx6 bundle · CVSS 8.1 High · Not analysed yet · Published 5 Mar 2024 · Tags: Hard-coded credentials - [Insufficiently protected credentials in Gallagher Command Centre Server](https://agentprime.io/advisories/CVE-2024-21815.md) `CVE-2024-21815` · CVE record: Gallagher Command Centre Server · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 5 Mar 2024 · Tags: Hard-coded credentials - [The Elink Smart eSmartCam (com.cn.dq.ipc) application 2.1.5 for Android contains hardcoded AES encryption keys that can be extracted from a binary file.](https://agentprime.io/advisories/CVE-2024-25731.md) `CVE-2024-25731` · CVE record · CVSS 7.5 High · Not analysed yet · Published 4 Mar 2024 · Tags: Hard-coded credentials - [IBM QRadar Suite information dislosure](https://agentprime.io/advisories/CVE-2024-22355.md) `CVE-2024-22355` · CVE record: IBM QRadar Suite Products and 1 more · CVSS 5.9 Medium · Not analysed yet · Published 3 Mar 2024 · Tags: Hard-coded credentials - [IBM Engineering Requirements Management information disclosure](https://agentprime.io/advisories/CVE-2023-50305.md) `CVE-2023-50305` · CVE record: IBM Engineering Requirements Management · CVSS 5.1 Medium · Not analysed yet · Published 1 Mar 2024 · Tags: Hard-coded credentials - [Microsoft Edge for Android (Chromium-based) Information Disclosure Vulnerability](https://agentprime.io/advisories/CVE-2024-26196.md) `CVE-2024-26196` · CVE record: Microsoft Microsoft Edge for Android · CVSS 4.3 Medium · Not analysed yet · Published 29 Feb 2024 · Tags: Hard-coded credentials - [An issue was discovered in Couchbase Server before 7.2.4. ns_server admin credentials are leaked in encoded form in the diag.log file.](https://agentprime.io/advisories/CVE-2023-50436.md) `CVE-2023-50436` · CVE record · CVSS 5.3 Medium · Not analysed yet · Published 28 Feb 2024 · Tags: Hard-coded credentials - [osuuu LightPicture TokenVerify.php handle hard-coded key](https://agentprime.io/advisories/CVE-2024-1920.md) `CVE-2024-1920` · CVE record: osuuu LightPicture · CVSS 5.6 Medium · Not analysed yet · Published 27 Feb 2024 · Tags: Hard-coded credentials - [@nfid/embed has compromised private key due to @dfinity/auth-client producing insecure session keys](https://agentprime.io/advisories/GHSA-84c3-j8r2-mcm8.md) `GHSA-84c3-j8r2-mcm8` · npm `@nfid/embed`: affected `>=0.10.0, <0.10.1-alpha.6`, fixed in `0.10.1-alpha.6` · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 26 Feb 2024 · Tags: Hard-coded credentials, Weak cryptography or TLS - [An issue was discovered in Yealink Configuration Encrypt Tool (AES version) and Yealink Configuration Encrypt Tool (RSA version before 1.2).](https://agentprime.io/advisories/CVE-2024-24681.md) `CVE-2024-24681` · CVE record · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 23 Feb 2024 · Tags: Hard-coded credentials - [agent-js: Insecure Key Generation in \`Ed25519KeyIdentity.generate\`](https://agentprime.io/advisories/GHSA-c9vv-fhgv-cjc3.md) `GHSA-c9vv-fhgv-cjc3`, `CVE-2024-1631` · npm `@dfinity/auth-client` and 1 more: affected `>=0.20.0-beta.0, <1.0.1`, fixed in `1.0.1` · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 21 Feb 2024 · Tags: Hard-coded credentials, Weak cryptography or TLS - [Totolink X6000R shadow hard-coded credentials](https://agentprime.io/advisories/CVE-2024-1661.md) `CVE-2024-1661` · CVE record: Totolink X6000R · CVSS 2.5 Low · Not analysed yet · Published 20 Feb 2024 · Tags: Hard-coded credentials - [Local Access to Sensitive Data in Brivo ACS100 and ACS300](https://agentprime.io/advisories/CVE-2023-6259.md) `CVE-2023-6259` · CVE record: Brivo ACS100, ACS300 · CVSS 7.1 High · Not analysed yet · Published 19 Feb 2024 · Tags: Broken access control, Hard-coded credentials - [Weak MySQL database root password in LaborOfficeFree](https://agentprime.io/advisories/CVE-2024-1346.md) `CVE-2024-1346` · CVE record: LaborOfficeFree LaborOfficeFree · CVSS 6.8 Medium · Not analysed yet · Published 19 Feb 2024 · Tags: Hard-coded credentials - [Weak MySQL database root password in LaborOfficeFree](https://agentprime.io/advisories/CVE-2024-1345.md) `CVE-2024-1345` · CVE record: LaborOfficeFree LaborOfficeFree · CVSS 6.8 Medium · Not analysed yet · Published 19 Feb 2024 · Tags: Hard-coded credentials - [Encrypted database credentials in LaborOfficeFree](https://agentprime.io/advisories/CVE-2024-1344.md) `CVE-2024-1344` · CVE record: LaborOfficeFree LaborOfficeFree · CVSS 6.8 Medium · Not analysed yet · Published 19 Feb 2024 · Tags: Hard-coded credentials - [Yealink Config Encrypt Tool add RSA before 1.2 has a built-in RSA key pair, and thus there is a risk of decryption by an adversary.](https://agentprime.io/advisories/CVE-2022-48625.md) `CVE-2022-48625` · CVE record · CVSS 7.5 High · Not analysed yet · Published 19 Feb 2024 · Tags: Hard-coded credentials - [Hardcoded Credentals in SoliClub Mobile App](https://agentprime.io/advisories/CVE-2023-6255.md) `CVE-2023-6255` · CVE record: Utarit Information Technologies SoliPay Mobile App · CVSS 7.5 High · Not analysed yet · Published 15 Feb 2024 · Tags: Hard-coded credentials - [Hard-coded credentials in iZZi connect application](https://agentprime.io/advisories/CVE-2024-0390.md) `CVE-2024-0390` · CVE record: INPRAX iZZi connect · CVSS 6.2 Medium · Not analysed yet · Published 15 Feb 2024 · Tags: Hard-coded credentials - [Hardcoded password in Comarch ERP XL](https://agentprime.io/advisories/CVE-2023-4539.md) `CVE-2023-4539` · CVE record: Comarch ERP XL · CVSS 7.5 High · Not analysed yet · Published 15 Feb 2024 · Tags: Hard-coded credentials - [Shared Key in Comarch ERP XL](https://agentprime.io/advisories/CVE-2023-4538.md) `CVE-2023-4538` · CVE record: Comarch ERP XL · CVSS 6.2 Medium · Not analysed yet · Published 15 Feb 2024 · Tags: Hard-coded credentials - [Insufficiently protected credentials in Schneider Electric EcoStruxure Control Expert and others](https://agentprime.io/advisories/CVE-2023-27975.md) `CVE-2023-27975` · CVE record: Schneider Electric EcoStruxure Control Expert and 1 more · CVSS 7.1 High · Not analysed yet · Published 14 Feb 2024 · Tags: Hard-coded credentials - [Hard-coded credentials in Schneider Electric EcoStruxure Control Expert and others](https://agentprime.io/advisories/CVE-2023-6409.md) `CVE-2023-6409` · CVE record: Schneider Electric EcoStruxure Control Expert and 1 more · CVSS 7.7 High · Not analysed yet · Published 14 Feb 2024 · Tags: Hard-coded credentials - [BIG-IP Next CNF & SPK vulnerability](https://agentprime.io/advisories/CVE-2024-23306.md) `CVE-2024-23306` · CVE record: F5 BIG-IP Next SPK and 1 more · CVSS 7.1 High · Not analysed yet · Published 14 Feb 2024 · Tags: Hard-coded credentials - [Insufficiently protected credentials in Intel(R) Server Product OpenBMC firmware](https://agentprime.io/advisories/CVE-2023-32280.md) `CVE-2023-32280` · CVE record: Intel(R) Server Product OpenBMC firmware · CVSS 5.3 Medium · Not analysed yet · Published 14 Feb 2024 · Tags: Hard-coded credentials - [Hard-coded credentials in Siemens Location Intelligence Perpetual Large and others](https://agentprime.io/advisories/CVE-2024-23816.md) `CVE-2024-23816` · CVE record: Siemens Location Intelligence Perpetual Large and 4 more · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 13 Feb 2024 · Tags: Hard-coded credentials - [IBM CICS TX session fixation](https://agentprime.io/advisories/CVE-2022-34311.md) `CVE-2022-34311` · CVE record: IBM CICS TX Standard and 1 more · CVSS 4.3 Medium · Not analysed yet · Published 12 Feb 2024 · Tags: Hard-coded credentials - [IBM DataStage on Cloud Pak for Data information disclosure](https://agentprime.io/advisories/CVE-2022-38714.md) `CVE-2022-38714` · CVE record: IBM DataStage on Cloud Pak for Data · CVSS 4.9 Medium · Not analysed yet · Published 12 Feb 2024 · Tags: Hard-coded credentials - [IBM Storage Defender - Resiliency Service information disclosure](https://agentprime.io/advisories/CVE-2024-22313.md) `CVE-2024-22313` · CVE record: IBM Storage Defender - Resiliency Service · CVSS 6.2 Medium · Not analysed yet · Published 10 Feb 2024 · Tags: Hard-coded credentials - [Apache Solr can leak certain passwords due to System Property redaction logic inconsistencies](https://agentprime.io/advisories/GHSA-3hwc-rqwp-v36q.md) `GHSA-3hwc-rqwp-v36q`, `BIT-solr-2023-50291`, `CVE-2023-50291` · Maven `org.apache.solr:solr-core`: affected `>=6.0.0, <8.11.3 || >=9.0.0, <9.3.0`, fixed in `8.11.3`, `9.3.0` · CVSS 7.5 High · Not analysed yet · Published 9 Feb 2024 · Tags: Hard-coded credentials - [IBM Security Access Manager Container information disclosure](https://agentprime.io/advisories/CVE-2023-38369.md) `CVE-2023-38369` · CVE record: IBM Security Verify Access Appliance and 1 more · CVSS 6.2 Medium · Not analysed yet · Published 7 Feb 2024 · Tags: Hard-coded credentials - [An issue in SCHUHFRIED v.8.22.00 allows remote attacker to obtain the database password via crafted curl command.](https://agentprime.io/advisories/CVE-2023-38995.md) `CVE-2023-38995` · CVE record · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 7 Feb 2024 · Tags: Hard-coded credentials - [Juanpao JPShop API params.php hard-coded key](https://agentprime.io/advisories/CVE-2024-1258.md) `CVE-2024-1258` · CVE record: Juanpao JPShop · CVSS 3.1 Low · Not analysed yet · Published 6 Feb 2024 · Tags: Hard-coded credentials - [Allegro AI ClearML Stores Credentials in Plaintext in MongoDB Instance](https://agentprime.io/advisories/GHSA-gvqv-h7hh-6fcc.md) `GHSA-gvqv-h7hh-6fcc`, `CVE-2024-24595`, `PYSEC-2026-1257` · PyPI `clearml`: affected `<=1.14.2`, no fixed version yet · CVSS 6.0 Medium · Not analysed yet · Published 6 Feb 2024 · Tags: Information disclosure, Hard-coded credentials - [D-LINK Go-RT-AC750 GORTAC750_A1_FW_v101b03 has a hardcoded password for the Alphanetworks account, which allows remote attackers to obtain root access via a telnet session.](https://agentprime.io/advisories/CVE-2024-22853.md) `CVE-2024-22853` · CVE record · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 6 Feb 2024 · Tags: Hard-coded credentials - [Use of Hard-Coded Credentials in Rapid SCADA](https://agentprime.io/advisories/CVE-2024-21764.md) `CVE-2024-21764` · CVE record: Rapid Software LLC Rapid SCADA · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 1 Feb 2024 · Tags: Hard-coded credentials - [MachineSense FeverWarn Use of Hard-coded Credentials](https://agentprime.io/advisories/CVE-2023-46706.md) `CVE-2023-46706` · CVE record: MachineSense FeverWarn · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 1 Feb 2024 · Tags: Hard-coded credentials - [Use of Hard-coded Credentials in Gessler GmbH WEB-MASTER](https://agentprime.io/advisories/CVE-2024-1039.md) `CVE-2024-1039` · CVE record: Gessler GmbH WEB-MASTER · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 1 Feb 2024 · Tags: Hard-coded credentials - [Weak password requirement vulnerability in Lamassu Bitcoin ATM Douro machines](https://agentprime.io/advisories/CVE-2024-0676.md) `CVE-2024-0676` · CVE record: Lamassu Bitcoin ATM Douro machines · CVSS 5.6 Medium · Not analysed yet · Published 30 Jan 2024 · Tags: Hard-coded credentials - [TOTOLINK A8000RU v7.1cu.643_B20200521 was discovered to contain a hardcoded password for root stored in /etc/shadow.](https://agentprime.io/advisories/CVE-2024-24324.md) `CVE-2024-24324` · CVE record · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 30 Jan 2024 · Tags: Hard-coded credentials - [Apache Kylin has Insufficiently Protected Credentials](https://agentprime.io/advisories/GHSA-3vvc-v8c2-43r7.md) `GHSA-3vvc-v8c2-43r7`, `CVE-2023-29055` · Maven `org.apache.kylin:kylin-core-common`: affected `>=2.0.0, <4.0.4`, fixed in `4.0.4` · CVSS 7.5 High · Not analysed yet · Published 29 Jan 2024 · Tags: Hard-coded credentials - [DoraCMS 2.1.8 is vulnerable to Use of Hard-coded Cryptographic Key.](https://agentprime.io/advisories/CVE-2023-51840.md) `CVE-2023-51840` · CVE record · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 29 Jan 2024 · Tags: Hard-coded credentials - [Encryption key derived from static host information](https://agentprime.io/advisories/CVE-2023-6482.md) `CVE-2023-6482` · CVE record: Synaptics Synaptics Fingerprint Driver · CVSS 5.2 Medium · Not analysed yet · Published 27 Jan 2024 · Tags: Hard-coded credentials - [IBM Merge Healthcare eFilm Workstation Hardcoded Credentials](https://agentprime.io/advisories/CVE-2024-23619.md) `CVE-2024-23619` · CVE record: IBM Merge Healthcare eFilm Workstation · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 25 Jan 2024 · Tags: Hard-coded credentials - [Hard-coded credentials in Spoon Radio Japan Inc. Android Spoon application](https://agentprime.io/advisories/CVE-2024-23453.md) `CVE-2024-23453` · CVE record: Spoon Radio Japan Inc. Android Spoon application · CVSS 5.5 Medium · Not analysed yet · Published 23 Jan 2024 · Tags: Hard-coded credentials Newest: Older: ## Filters and formats Filters are query parameters on this URL: `q` (words, as in a web search engine: `"a phrase"`, `OR`, `-word`; an id; a package or product name), `severity` (low, medium, high or critical), `critical=1`, `kev=1`, `ecosystem` (npm, pypi, packagist, go, maven, rubygems, crates, nuget, hex), `kind=package`, `assigner` (a CNA’s short name), `min_score` and `state`. Each record’s title links to its Markdown page. - The same list as JSON: - Every list: , critical: ; by weakness: and the other tags in ; by technology: `/advisories/technology/.md` (`fortinet-fortimail`) --- The web page: . Everything for agents: .