# Hard-coded credentials. Passwords and keys built into the code, or weak credentials. Every Advisory and CVE whose weakness (CWE) is one of these, newest first. ## Records, newest first (an older page) - [demozx gf_cms JWT Authentication auth.go init hard-coded credentials](https://agentprime.io/advisories/CVE-2024-8005.md) `CVE-2024-8005` · CVE record: demozx gf_cms · CVSS 6.9 Medium · Not analysed yet · Published 20 Aug 2024 · Tags: Hard-coded credentials - [Silverpeas vulnerable to password complexity rule bypass](https://agentprime.io/advisories/GHSA-h6jq-w432-j26w.md) `GHSA-h6jq-w432-j26w`, `CVE-2024-42850` · Maven `org.silverpeas.core:silverpeas-core`: affected `<=6.4.2`, no fixed version yet · CVSS 4.3 Medium · Not analysed yet · Published 16 Aug 2024 · Tags: Hard-coded credentials - [H3C GR1100-P v100R009 was discovered to use a hardcoded password in /etc/shadow, which allows attackers to log in as root.](https://agentprime.io/advisories/CVE-2024-42639.md) `CVE-2024-42639` · CVE record · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 16 Aug 2024 · Tags: Hard-coded credentials - [H3C Magic B1ST v100R012 was discovered to contain a hardcoded password vulnerability in /etc/shadow, which allows attackers to log in as root.](https://agentprime.io/advisories/CVE-2024-42638.md) `CVE-2024-42638` · CVE record · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 16 Aug 2024 · Tags: Hard-coded credentials - [H3C R3010 v100R002L02 was discovered to contain a hardcoded password vulnerability in /etc/shadow, which allows attackers to log in as root.](https://agentprime.io/advisories/CVE-2024-42637.md) `CVE-2024-42637` · CVE record · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 16 Aug 2024 · Tags: Hard-coded credentials - [IBM InfoSphere Information Server information disclosure](https://agentprime.io/advisories/CVE-2024-40704.md) `CVE-2024-40704` · CVE record: IBM InfoSphere Information Server · CVSS 4.9 Medium · Not analysed yet · Published 15 Aug 2024 · Tags: Hard-coded credentials - [SourceCodester Prison Management System Profile Image insufficiently protected credentials](https://agentprime.io/advisories/CVE-2024-7813.md) `CVE-2024-7813` · CVE record: SourceCodester Prison Management System · CVSS 6.9 Medium · Not analysed yet · Published 15 Aug 2024 · Tags: Hard-coded credentials - [Authentication Bypass in GNCC's GC2 Indoor Security Camera 1080P allows an attacker with physical access to gain a privileged command shell via the UART Debugging Port.](https://agentprime.io/advisories/CVE-2024-31800.md) `CVE-2024-31800` · CVE record · CVSS 6.8 Medium · Not analysed yet · Published 15 Aug 2024 · Tags: Hard-coded credentials - [Identical Hardcoded Root Password for All Devices in GNCC's GC2 Indoor Security Camera 1080P allows an attacker with physical access to retrieve the root password for all similar devices](https://agentprime.io/advisories/CVE-2024-31798.md) `CVE-2024-31798` · CVE record · CVSS 6.4 Medium · Not analysed yet · Published 15 Aug 2024 · Tags: Hard-coded credentials - [Zoom Workplace Apps and SDKs - Protection Mechanism Failure](https://agentprime.io/advisories/CVE-2024-39818.md) `CVE-2024-39818` · CVE record: Zoom Communications Inc. Zoom Workplace Apps and SDKs · CVSS 7.5 High · Not analysed yet · Published 14 Aug 2024 · Tags: Hard-coded credentials - [NetBird uses a static initialization vector (IV) in github.com/netbirdio/netbird](https://agentprime.io/advisories/GHSA-9v35-4xcr-w9ph.md) `GHSA-9v35-4xcr-w9ph`, `CVE-2024-41260`, `GO-2024-3057` · Go `github.com/netbirdio/netbird`: affected `>=0.23.2, <0.29.2`, fixed in `0.29.2` · CVSS 7.5 High · Not analysed yet · Published 13 Aug 2024 · Tags: Hard-coded credentials - [Hard-coded credentials in AMD Radeon™ RX 6000 Series Graphics Cards and others](https://agentprime.io/advisories/CVE-2023-20512.md) `CVE-2023-20512` · CVE record: AMD AMD Radeon™ RX 6000 Series Graphics Cards and 1 more · CVSS 1.9 Low · Not analysed yet · Published 13 Aug 2024 · Tags: Hard-coded credentials - [IBM Common Licensing information disclosure](https://agentprime.io/advisories/CVE-2024-40697.md) `CVE-2024-40697` · CVE record: IBM Common Licensing · CVSS 7.5 High · Not analysed yet · Published 13 Aug 2024 · Tags: Hard-coded credentials - [Weak password requirements in Siemens Location Intelligence family](https://agentprime.io/advisories/CVE-2024-41683.md) `CVE-2024-41683` · CVE record: Siemens Location Intelligence family · CVSS 6.9 Medium · Not analysed yet · Published 13 Aug 2024 · Tags: Hard-coded credentials - [Firewalla BTLE Weak Credentials](https://agentprime.io/advisories/CVE-2024-40892.md) `CVE-2024-40892` · CVE record: Firewalla Box Software · CVSS 7.1 High · Not analysed yet · Published 12 Aug 2024 · Tags: Hard-coded credentials - [Vonets WiFi Bridges Use of Hard-coded Credentials](https://agentprime.io/advisories/CVE-2024-41161.md) `CVE-2024-41161` · CVE record: Vonets VAR1200-H and 4 more · CVSS 8.7 High · Not analysed yet · Published 8 Aug 2024 · Tags: Hard-coded credentials - [Journyx Unauthenticated Password Reset Bruteforce](https://agentprime.io/advisories/CVE-2024-6890.md) `CVE-2024-6890` · CVE record: Journyx Journyx (jtime) · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 7 Aug 2024 · Tags: Hard-coded credentials, CWE-334, CWE-799 - [D-Link DIR-300 REVA FIRMWARE v1.06B05_WW contains hardcoded credentials in the Telnet service.](https://agentprime.io/advisories/CVE-2024-41616.md) `CVE-2024-41616` · CVE record · CVSS 8.8 High · Not analysed yet · Published 6 Aug 2024 · Tags: Hard-coded credentials - [Apereo CAS vulnerable to credential leaks for LDAP authentication](https://agentprime.io/advisories/GHSA-p78h-m8pv-g9gm.md) `GHSA-p78h-m8pv-g9gm`, `CVE-2023-28857` · Maven `org.apereo.cas:cas-server-support-x509-core`: affected `>=6.5.0, <6.6.6`, fixed in `6.6.6` · CVSS 4.0 Medium · Not analysed yet · Published 5 Aug 2024 · Tags: Information disclosure, Hard-coded credentials - [Hard-coded credentials in ZEXELON CO., LTD. ZWX-2000CSW2-HN](https://agentprime.io/advisories/CVE-2024-39838.md) `CVE-2024-39838` · CVE record: ZEXELON CO., LTD. ZWX-2000CSW2-HN · CVSS 8.8 High · Not analysed yet · Published 5 Aug 2024 · Tags: Hard-coded credentials - [Forminator <= 1.29.1 - HubSpot Developer API Key Sensitive Information Exposure](https://agentprime.io/advisories/CVE-2024-7389.md) `CVE-2024-7389` · CVE record: wpmudev Forminator Forms – Contact Form, Payment Form & Custom Form Builder · CVSS 7.5 High · Not analysed yet · Published 2 Aug 2024 · Tags: Hard-coded credentials - [An issue in Horizon Business Services Inc.](https://agentprime.io/advisories/CVE-2024-38885.md) `CVE-2024-38885` · CVE record · CVSS 7.5 High · Not analysed yet · Published 2 Aug 2024 · Tags: Hard-coded credentials - [Cosy+ devices running a firmware 21.x below 21.2s10 or a firmware 22.x below 22.1s3 use a unique key to encrypt the configuration parameters.](https://agentprime.io/advisories/CVE-2024-33895.md) `CVE-2024-33895` · CVE record · CVSS 6.6 Medium · Not analysed yet · Published 2 Aug 2024 · Tags: Hard-coded credentials - [TOTOLINK CP450 Telnet Service product.ini hard-coded password](https://agentprime.io/advisories/CVE-2024-7332.md) `CVE-2024-7332` · CVE record: TOTOLINK CP450 · CVSS 9.3 Critical · Critical (CVSS 9+, CVSS 7+ and EPSS) · EPSS 0.21 · Not analysed yet · Published 1 Aug 2024 · Tags: Hard-coded credentials - [TOTOLINK LR1200 shadow.sample hard-coded password](https://agentprime.io/advisories/CVE-2024-7216.md) `CVE-2024-7216` · CVE record: TOTOLINK LR1200 · CVSS 2.1 Low · Not analysed yet · Published 30 Jul 2024 · Tags: Hard-coded credentials - [In D-Link DIR-860L REVA FIRMWARE PATCH 1.10..B04, the Telnet service contains hardcoded credentials, enabling attackers to log in remotely to the Telnet service and perform arbitrary commands.](https://agentprime.io/advisories/CVE-2024-41611.md) `CVE-2024-41611` · CVE record · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 30 Jul 2024 · Tags: Hard-coded credentials - [D-Link DIR-820LW REVB FIRMWARE PATCH 2.03.B01_TC contains hardcoded credentials in the Telnet service, enabling attackers to log in remotely to the Telnet service and perform arbitrary commands.](https://agentprime.io/advisories/CVE-2024-41610.md) `CVE-2024-41610` · CVE record · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 30 Jul 2024 · Tags: Hard-coded credentials - [TOTOLINK A3000RU product.ini hard-coded password](https://agentprime.io/advisories/CVE-2024-7170.md) `CVE-2024-7170` · CVE record: TOTOLINK A3000RU · CVSS 5.1 Medium · Not analysed yet · Published 28 Jul 2024 · Tags: Hard-coded credentials - [TOTOLINK A3600R Telnet Service product.ini hard-coded password](https://agentprime.io/advisories/CVE-2024-7159.md) `CVE-2024-7159` · CVE record: TOTOLINK A3600R · CVSS 5.1 Medium · Not analysed yet · Published 28 Jul 2024 · Tags: Hard-coded credentials - [TOTOLINK A3300R shadow.sample hard-coded password](https://agentprime.io/advisories/CVE-2024-7155.md) `CVE-2024-7155` · CVE record: TOTOLINK A3300R · CVSS 2.0 Low · Not analysed yet · Published 28 Jul 2024 · Tags: Hard-coded credentials - [The MSI installer for Splashtop Streamer for Windows before 3.6.2.0 uses a temporary folder with weak permissions during installation.](https://agentprime.io/advisories/CVE-2024-42051.md) `CVE-2024-42051` · CVE record · CVSS 7.8 High · Not analysed yet · Published 28 Jul 2024 · Tags: Hard-coded credentials - [Hard-coded Credentials Vulnerability](https://agentprime.io/advisories/CVE-2024-41689.md) `CVE-2024-41689` · CVE record: SyroTech SyroTech SY-GPON-1110-WDONT router · CVSS 5.2 Medium · Not analysed yet · Published 26 Jul 2024 · Tags: Hard-coded credentials - [AdTran 834-5 HDC17600021F1 (SmartOS 11.1.1.1) devices enable the SSH service by default and have a hidden, undocumented, hard-coded support account whose password is based on the devices MAC address.](https://agentprime.io/advisories/CVE-2024-39345.md) `CVE-2024-39345` · CVE record · CVSS 7.5 High · Not analysed yet · Published 24 Jul 2024 · Tags: Hard-coded credentials - [Hardcoded MSSQL Credentials](https://agentprime.io/advisories/CVE-2024-6912.md) `CVE-2024-6912` · CVE record: PerkinElmer ProcessPlus · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 22 Jul 2024 · Tags: Hard-coded credentials - [Hard-coded cryptographic key in Cisco Intelligent Node Manager and others](https://agentprime.io/advisories/CVE-2024-20323.md) `CVE-2024-20323` · CVE record: Cisco Cisco Intelligent Node Manager and 1 more · CVSS 7.5 High · Not analysed yet · Published 17 Jul 2024 · Tags: Hard-coded credentials - [Agent takeover](https://agentprime.io/advisories/CVE-2024-5471.md) `CVE-2024-5471` · CVE record: ManageEngine DDI Central · CVSS 8.8 High · Not analysed yet · Published 17 Jul 2024 · Tags: Hard-coded credentials - [Insufficiently protected credentials in Devolutions Remote Desktop Manager](https://agentprime.io/advisories/CVE-2024-6492.md) `CVE-2024-6492` · CVE record: Devolutions Remote Desktop Manager · CVSS 7.4 High · Not analysed yet · Published 16 Jul 2024 · Tags: Hard-coded credentials - [Tenda i29V1.0 V1.0.0.5 was discovered to contain a hardcoded password for root.](https://agentprime.io/advisories/CVE-2024-35338.md) `CVE-2024-35338` · CVE record · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 16 Jul 2024 · Tags: Hard-coded credentials - [Johnson Controls Software House C●CURE 9000 installer password strength](https://agentprime.io/advisories/CVE-2024-32759.md) `CVE-2024-32759` · CVE record: Johnson Controls Software House C•CURE 9000 · CVSS 7.7 High · Not analysed yet · Published 10 Jul 2024 · Tags: Hard-coded credentials - [Weak credentials in Longse Technology LBH30FE200W and others](https://agentprime.io/advisories/CVE-2024-5634.md) `CVE-2024-5634` · CVE record: Longse Technology LBH30FE200W and 1 more · CVSS 8.6 High · Not analysed yet · Published 9 Jul 2024 · Tags: Hard-coded credentials - [WP2Speed Faster – Optimize PageSpeed Insights Score 90-100 <= 1.0.1 - Improper Authorization due to use of Hardcoded Credentials](https://agentprime.io/advisories/CVE-2024-5810.md) `CVE-2024-5810` · CVE record: wp2speed WP2Speed Faster – Optimize PageSpeed Insights Score 90-100 · CVSS 5.3 Medium · Not analysed yet · Published 9 Jul 2024 · Tags: Hard-coded credentials - [ifm: Hardcoded telnet credentials in Smart PLC](https://agentprime.io/advisories/CVE-2024-28751.md) `CVE-2024-28751` · CVE record: ifm Smart PLC AC14xx Firmware and 1 more · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 9 Jul 2024 · Tags: Hard-coded credentials - [ifm: Use of Hard-coded Credentials](https://agentprime.io/advisories/CVE-2024-28747.md) `CVE-2024-28747` · CVE record: ifm Smart PLC AC14xx Firmware and 1 more · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 9 Jul 2024 · Tags: Hard-coded credentials - [ZKTeco ZKBio CVSecurity v6.1.1 was discovered to contain a hardcoded cryptographic key.](https://agentprime.io/advisories/CVE-2024-36526.md) `CVE-2024-36526` · CVE record · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 9 Jul 2024 · Tags: Hard-coded credentials - [Hard-coded password in LevelOne WBR-6013](https://agentprime.io/advisories/CVE-2023-46685.md) `CVE-2023-46685` · CVE record: LevelOne WBR-6013 · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 8 Jul 2024 · Tags: Hard-coded credentials - [The Avalara for Salesforce CPQ app before 7.0 for Salesforce allows attackers to read an API key.](https://agentprime.io/advisories/CVE-2024-38453.md) `CVE-2024-38453` · CVE record · CVSS 7.5 High · Not analysed yet · Published 3 Jul 2024 · Tags: Hard-coded credentials, Information disclosure - [mySCADA myPRO Use of Hard-coded Password](https://agentprime.io/advisories/CVE-2024-4708.md) `CVE-2024-4708` · CVE record: mySCADA myPRO · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 2 Jul 2024 · Tags: Hard-coded credentials - [Insufficiently protected credentials in Kiloview P1/P2 devices](https://agentprime.io/advisories/CVE-2023-41926.md) `CVE-2023-41926` · CVE record: Kiloview P1/P2 · CVSS 8.8 High · Not analysed yet · Published 2 Jul 2024 · Tags: Hard-coded credentials - [Weak Password Requirements in Kiloview P1/P2 devices](https://agentprime.io/advisories/CVE-2023-41923.md) `CVE-2023-41923` · CVE record: Kiloview P1/P2 · CVSS 7.2 High · Not analysed yet · Published 2 Jul 2024 · Tags: Hard-coded credentials - [Use of Hard-coded Credentials in Kiloview P1/P2 devices](https://agentprime.io/advisories/CVE-2023-41919.md) `CVE-2023-41919` · CVE record: Kiloview P1/P2 · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 2 Jul 2024 · Tags: Hard-coded credentials - [Insufficiently protected credentials in JetBrains TeamCity](https://agentprime.io/advisories/CVE-2024-39879.md) `CVE-2024-39879` · CVE record: JetBrains TeamCity · CVSS 5.0 Medium · Not analysed yet · Published 1 Jul 2024 · Tags: Hard-coded credentials - [Insufficiently protected credentials in JetBrains TeamCity](https://agentprime.io/advisories/CVE-2024-39878.md) `CVE-2024-39878` · CVE record: JetBrains TeamCity · CVSS 4.1 Medium · Not analysed yet · Published 1 Jul 2024 · Tags: Hard-coded credentials - [Hard-coded credentials in Kakao piccoma Corp. "Piccoma" App for Android and others](https://agentprime.io/advisories/CVE-2024-38480.md) `CVE-2024-38480` · CVE record: Kakao piccoma Corp. "Piccoma" App for Android and 1 more · CVSS 4.0 Medium · Not analysed yet · Published 1 Jul 2024 · Tags: Hard-coded credentials - [TEST_KEY used in example dcp_tool reference implementation](https://agentprime.io/advisories/CVE-2024-38532.md) `CVE-2024-38532` · CVE record: usbarmory mxs-dcp · CVSS 7.1 High · Not analysed yet · Published 28 Jun 2024 · Tags: Hard-coded credentials - [Use of Hard-coded Credentials in TELSAT marKoni FM Transmitter](https://agentprime.io/advisories/CVE-2024-39374.md) `CVE-2024-39374` · CVE record: marKoni Markoni-D (Compact) FM Transmitters and 1 more · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 27 Jun 2024 · Tags: Hard-coded credentials - [Improper Access Control in Talya Informatics' Elektraweb](https://agentprime.io/advisories/CVE-2024-0949.md) `CVE-2024-0949` · CVE record: Talya Informatics Elektraweb · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 27 Jun 2024 · Tags: Authentication bypass, Information disclosure, Hard-coded credentials - [luci-app-lucky v2.8.3 was discovered to contain hardcoded credentials.](https://agentprime.io/advisories/CVE-2024-39208.md) `CVE-2024-39208` · CVE record · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 27 Jun 2024 · Tags: Hard-coded credentials - [A hardcoded privileged ID within Lumisxp v15.0.x to v16.1.x allows attackers to bypass authentication and access internal pages and other sensitive information.](https://agentprime.io/advisories/CVE-2024-33329.md) `CVE-2024-33329` · CVE record · CVSS 7.5 High · Not analysed yet · Published 26 Jun 2024 · Tags: Hard-coded credentials - [Brocade Fabric OS versions prior to v9.0 have default community strings](https://agentprime.io/advisories/CVE-2024-5460.md) `CVE-2024-5460` · CVE record: Brocade Fabric OS · CVSS 8.1 High · Not analysed yet · Published 25 Jun 2024 · Tags: Hard-coded credentials - [Hard Coded Credential](https://agentprime.io/advisories/CVE-2023-6198.md) `CVE-2023-6198` · CVE record: Baicells Snap Router · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 25 Jun 2024 · Tags: Hard-coded credentials Newest: Older: ## Filters and formats Filters are query parameters on this URL: `q` (words, as in a web search engine: `"a phrase"`, `OR`, `-word`; an id; a package or product name), `severity` (low, medium, high or critical), `critical=1`, `kev=1`, `ecosystem` (npm, pypi, packagist, go, maven, rubygems, crates, nuget, hex), `kind=package`, `assigner` (a CNA’s short name), `min_score` and `state`. Each record’s title links to its Markdown page. - The same list as JSON: - Every list: , critical: ; by weakness: and the other tags in ; by technology: `/advisories/technology/.md` (`fortinet-fortimail`) --- The web page: . Everything for agents: .