# Hard-coded credentials. Passwords and keys built into the code, or weak credentials. Every Advisory and CVE whose weakness (CWE) is one of these, newest first. ## Records, newest first (an older page) - [HPE IceWall Products, Remote Unauthorized Data Modification](https://agentprime.io/advisories/CVE-2024-11856.md) `CVE-2024-11856` · CVE record: Hewlett Packard Enterprise HPE IceWall · CVSS 3.7 Low · Not analysed yet · Published 2 Dec 2024 · Tags: Hard-coded credentials - [Ever Traduora 0.20.0 and below is vulnerable to Privilege Escalation due to the use of a hard-coded JWT signing key.](https://agentprime.io/advisories/CVE-2024-53484.md) `CVE-2024-53484` · CVE record · CVSS 8.8 High · Not analysed yet · Published 2 Dec 2024 · Tags: Hard-coded credentials - [IBM Security Verify Access Appliance hard coded credentials](https://agentprime.io/advisories/CVE-2024-49806.md) `CVE-2024-49806` · CVE record: IBM Security Verify Access · CVSS 9.4 Critical · Critical (CVSS 9+) · Not analysed yet · Published 29 Nov 2024 · Tags: Hard-coded credentials - [IBM Security Verify Access Appliance hard coded credentials](https://agentprime.io/advisories/CVE-2024-49805.md) `CVE-2024-49805` · CVE record: IBM Security Verify Access · CVSS 9.4 Critical · Critical (CVSS 9+) · Not analysed yet · Published 29 Nov 2024 · Tags: Hard-coded credentials - [Insufficiently protected credentials in OpenText™ AccuRev](https://agentprime.io/advisories/CVE-2019-17082.md) `CVE-2019-17082` · CVE record: OpenText™ AccuRev · CVSS 9.0 Critical · Critical (CVSS 9+) · Not analysed yet · Published 26 Nov 2024 · Tags: Hard-coded credentials - [Insufficiently protected credentials in Mozilla Firefox](https://agentprime.io/advisories/CVE-2024-11703.md) `CVE-2024-11703` · CVE record: Mozilla Firefox · CVSS 5.7 Medium · Not analysed yet · Published 26 Nov 2024 · Tags: Hard-coded credentials - [Hard-coded credentials in Sharp Corporation Multiple MFPs (multifunction printers) and others](https://agentprime.io/advisories/CVE-2024-36248.md) `CVE-2024-36248` · CVE record: Sharp Corporation Multiple MFPs (multifunction printers) and 1 more · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 26 Nov 2024 · Tags: Hard-coded credentials - [Hard-coded credentials in Sharp Corporation Multiple MFPs (multifunction printers) and others](https://agentprime.io/advisories/CVE-2024-35244.md) `CVE-2024-35244` · CVE record: Sharp Corporation Multiple MFPs (multifunction printers) and 1 more · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 26 Nov 2024 · Tags: Hard-coded credentials - [Insufficiently protected credentials in Axis Communications AB AXIS Camera Station Pro and others](https://agentprime.io/advisories/CVE-2024-6749.md) `CVE-2024-6749` · CVE record: Axis Communications AB AXIS Camera Station Pro and 1 more · CVSS 6.3 Medium · Not analysed yet · Published 26 Nov 2024 · Tags: Hard-coded credentials - [Keycloak Build Process Exposes Sensitive Data](https://agentprime.io/advisories/GHSA-v7gv-xpgf-6395.md) `GHSA-v7gv-xpgf-6395`, `CVE-2024-10451` · Maven `org.keycloak:keycloak-quarkus-server`: affected `<24.0.9 || >=25.0.0, <26.0.6`, fixed in `24.0.9`, `26.0.6` · CVSS 5.9 Medium · Not analysed yet · Published 25 Nov 2024 · Tags: Hard-coded credentials - [Duplicate Advisory: Keycloak Build Process Exposes Sensitive Data](https://agentprime.io/advisories/GHSA-jcgg-mg9g-p9wf.md) `GHSA-jcgg-mg9g-p9wf` · Maven `org.keycloak:keycloak-quarkus-server`: affected `<24.0.9 || >=25.0.0, <26.0.6`, fixed in `24.0.9`, `26.0.6` · CVSS 5.9 Medium · Withdrawn · Not analysed yet · Published 25 Nov 2024 · Tags: Hard-coded credentials - [E-Lins H685/H685f/H700/H720/H750/H820/H820Q/H820Q0/H900 OEM Backend hard-coded credentials](https://agentprime.io/advisories/CVE-2024-11630.md) `CVE-2024-11630` · CVE record: E-Lins H685 and 4 more · CVSS 6.9 Medium · Not analysed yet · Published 22 Nov 2024 · Tags: Hard-coded credentials - [Logsign Unified SecOps Platform HTTP API Hard-coded Cryptographic Key Remote Code Execution Vulnerability](https://agentprime.io/advisories/CVE-2024-5722.md) `CVE-2024-5722` · CVE record: Logsign Unified SecOps Platform · CVSS 8.8 High · Not analysed yet · Published 22 Nov 2024 · Tags: Hard-coded credentials - [Allegra Hard-coded Credentials Authentication Bypass Vulnerability](https://agentprime.io/advisories/CVE-2023-51638.md) `CVE-2023-51638` · CVE record: Allegra Allegra · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 22 Nov 2024 · Tags: Hard-coded credentials - [Insufficiently protected credentials in AIPHONE CO., LTD. IXG-2C7 and others](https://agentprime.io/advisories/CVE-2024-47142.md) `CVE-2024-47142` · CVE record: AIPHONE CO., LTD. IXG-2C7 and 1 more · CVSS 5.5 Medium · Not analysed yet · Published 22 Nov 2024 · Tags: Hard-coded credentials - [Hard-coded cryptographic key in AIPHONE CO., LTD. IX-MV and others](https://agentprime.io/advisories/CVE-2024-45837.md) `CVE-2024-45837` · CVE record: AIPHONE CO., LTD. IX-MV and 4 more · CVSS 5.4 Medium · Not analysed yet · Published 22 Nov 2024 · Tags: Hard-coded credentials - [Insufficiently protected credentials in AIPHONE CO., LTD. IX-MV and others](https://agentprime.io/advisories/CVE-2024-39290.md) `CVE-2024-39290` · CVE record: AIPHONE CO., LTD. IX-MV and 4 more · CVSS 6.5 Medium · Not analysed yet · Published 22 Nov 2024 · Tags: Hard-coded credentials - [Hard-coded cryptographic key in EPARK, Inc. Kura Sushi Official App Produced by EPARK](https://agentprime.io/advisories/CVE-2024-52614.md) `CVE-2024-52614` · CVE record: EPARK, Inc. Kura Sushi Official App Produced by EPARK · CVSS 4.0 Medium · Not analysed yet · Published 20 Nov 2024 · Tags: Hard-coded credentials - [Hard-coded credentials in Versa Director](https://agentprime.io/advisories/CVE-2024-42450.md) `CVE-2024-42450` · CVE record: Versa Director · CVSS 10.0 Critical · Critical (CVSS 9+) · Not analysed yet · Published 19 Nov 2024 · Tags: Hard-coded credentials - [Tenda W30E v2.0 V16.01.0.8 was discovered to contain a hardcoded password vulnerability in /etc_ro/shadow, which allows attackers to log in as root.](https://agentprime.io/advisories/CVE-2024-52789.md) `CVE-2024-52789` · CVE record · CVSS 8.0 High · Not analysed yet · Published 19 Nov 2024 · Tags: Hard-coded credentials - [Tenda W9 v1.0.0.7(4456) was discovered to contain a hardcoded password vulnerability in /etc_ro/shadow, which allows attackers to log in as root.](https://agentprime.io/advisories/CVE-2024-52788.md) `CVE-2024-52788` · CVE record · CVSS 8.0 High · Not analysed yet · Published 19 Nov 2024 · Tags: Hard-coded credentials - [Cisco SD-WAN vManage Information Disclosure Vulnerability](https://agentprime.io/advisories/CVE-2021-1232.md) `CVE-2021-1232` · CVE record: Cisco Cisco Catalyst SD-WAN Manager · CVSS 6.5 Medium · Not analysed yet · Published 18 Nov 2024 · Tags: Hard-coded credentials - [TRCore DVC - Use of Hard-coded Cryptographic Key](https://agentprime.io/advisories/CVE-2024-11308.md) `CVE-2024-11308` · CVE record: TRCore DVC · CVSS 6.2 Medium · Not analysed yet · Published 18 Nov 2024 · Tags: Hard-coded credentials - [Azure Stack HCI Elevation of Privilege Vulnerability](https://agentprime.io/advisories/CVE-2024-49060.md) `CVE-2024-49060` · CVE record: Microsoft Azure Stack HCI OS · CVSS 8.8 High · Not analysed yet · Published 15 Nov 2024 · Tags: Hard-coded credentials - [Clinician Password and Serial Number Clinician Password are hard-coded in Life2000 Ventilator](https://agentprime.io/advisories/CVE-2024-48971.md) `CVE-2024-48971` · CVE record: Baxter Life2000 Ventilation System · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 14 Nov 2024 · Tags: Hard-coded credentials - [DataEase has a forged JWT token vulnerability](https://agentprime.io/advisories/CVE-2024-52295.md) `CVE-2024-52295` · CVE record: dataease dataease · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 13 Nov 2024 · Tags: Hard-coded credentials - [Hard-coded credentials used for temporary and cache data encryption](https://agentprime.io/advisories/CVE-2024-7295.md) `CVE-2024-7295` · CVE record: Progress Software Corporation Telerik Report Server · CVSS 7.1 High · Not analysed yet · Published 13 Nov 2024 · Tags: Hard-coded credentials - [Cybele Software Thinfinity Workspace before v7.0.2.113 was discovered to contain a hardcoded cryptographic key used for encryption.](https://agentprime.io/advisories/CVE-2024-40410.md) `CVE-2024-40410` · CVE record · CVSS 4.8 Medium · Not analysed yet · Published 13 Nov 2024 · Tags: Hard-coded credentials - [Hard-coded cryptographic key in Siemens SINEC INS](https://agentprime.io/advisories/CVE-2024-46889.md) `CVE-2024-46889` · CVE record: Siemens SINEC INS · CVSS 6.9 Medium · Not analysed yet · Published 12 Nov 2024 · Tags: Hard-coded credentials - [Information Disclosure vulnerability in SAP NetWeaver Java (Software Update Manager)](https://agentprime.io/advisories/CVE-2024-47588.md) `CVE-2024-47588` · CVE record: SAP_SE SAP NetWeaver Java (Software Update Manager) · CVSS 4.7 Medium · Not analysed yet · Published 12 Nov 2024 · Tags: Hard-coded credentials - [Intelligent Apps Freenow App Keystore SSL.java hard-coded password](https://agentprime.io/advisories/CVE-2024-11026.md) `CVE-2024-11026` · CVE record: Intelligent Apps Freenow App · CVSS 6.3 Medium · Not analysed yet · Published 8 Nov 2024 · Tags: Hard-coded credentials, CWE-255 - [Hardcoded Service Password](https://agentprime.io/advisories/CVE-2024-50593.md) `CVE-2024-50593` · CVE record: HASOMED Elefant · CVSS 7.8 High · Not analysed yet · Published 8 Nov 2024 · Tags: Hard-coded credentials - [mariazevedo88 travels-java-api JWT Secret JwtAuthenticationTokenFilter.java doFilterInternal hard-coded key](https://agentprime.io/advisories/CVE-2024-10920.md) `CVE-2024-10920` · CVE record: mariazevedo88 travels-java-api · CVSS 2.3 Low · Not analysed yet · Published 6 Nov 2024 · Tags: Hard-coded credentials, CWE-320 - [An issue in the luci-mod-rpc package in OpenWRT Luci LTS allows for privilege escalation from an admin account to root via the JSON-RPC-API, which is exposed by the luci-mod-rpc package](https://agentprime.io/advisories/CVE-2024-51240.md) `CVE-2024-51240` · CVE record · CVSS 8.0 High · Not analysed yet · Published 5 Nov 2024 · Tags: Hard-coded credentials - [Insufficiently protected credentials in AD/LDAP server settings in 1C-Bitrix Bitrix24 23.300.100 allows remote administrators to send AD/LDAP administrators account passwords to an arbitrary server v…](https://agentprime.io/advisories/CVE-2024-34887.md) `CVE-2024-34887` · CVE record · CVSS 6.8 Medium · Not analysed yet · Published 4 Nov 2024 · Tags: Hard-coded credentials - [Insufficiently protected credentials in SMTP server settings in 1C-Bitrix Bitrix24 23.300.100 allows remote administrators to read SMTP accounts passwords via HTTP GET request.](https://agentprime.io/advisories/CVE-2024-34885.md) `CVE-2024-34885` · CVE record · CVSS 6.8 Medium · Not analysed yet · Published 4 Nov 2024 · Tags: Hard-coded credentials - [Insufficiently protected credentials in DAV server settings in 1C-Bitrix Bitrix24 23.300.100 allow remote administrators to read proxy-server accounts passwords via HTTP GET request.](https://agentprime.io/advisories/CVE-2024-34883.md) `CVE-2024-34883` · CVE record · CVSS 6.8 Medium · Not analysed yet · Published 4 Nov 2024 · Tags: Hard-coded credentials - [Insufficiently protected credentials in SMTP server settings in 1C-Bitrix Bitrix24 23.300.100 allows remote administrators to send SMTP account passwords to an arbitrary server via HTTP POST request.](https://agentprime.io/advisories/CVE-2024-34882.md) `CVE-2024-34882` · CVE record · CVSS 6.8 Medium · Not analysed yet · Published 4 Nov 2024 · Tags: Hard-coded credentials - [LB-LINK BL-WR 1300H v.1.0.4 contains hardcoded credentials stored in /etc/shadow which are easily guessable.](https://agentprime.io/advisories/CVE-2024-51431.md) `CVE-2024-51431` · CVE record · CVSS 8.1 High · Not analysed yet · Published 1 Nov 2024 · Tags: Hard-coded credentials - [Altai Technologies Ltd Altai X500 Indoor 22 802.11ac Wave 2 AP web Management Weak password leakage in the background may lead to unauthorized access, data theft, and network attacks, seriously threa…](https://agentprime.io/advisories/CVE-2024-51398.md) `CVE-2024-51398` · CVE record · CVSS 6.5 Medium · Not analysed yet · Published 1 Nov 2024 · Tags: Hard-coded credentials - [Hard-coded credentials in LevelOne WBR-6012](https://agentprime.io/advisories/CVE-2024-31151.md) `CVE-2024-31151` · CVE record: LevelOne WBR-6012 · CVSS 8.1 High · Not analysed yet · Published 30 Oct 2024 · Tags: Hard-coded credentials - [Hard-coded credentials in LevelOne WBR-6012](https://agentprime.io/advisories/CVE-2024-28875.md) `CVE-2024-28875` · CVE record: LevelOne WBR-6012 · CVSS 8.1 High · Not analysed yet · Published 30 Oct 2024 · Tags: Hard-coded credentials - [D-Link DSL6740C v6.TR069.20211230 was discovered to use an insecure default Wifi password, possibly allowing attackers to connect to the device via a bruteforce attack.](https://agentprime.io/advisories/CVE-2024-48272.md) `CVE-2024-48272` · CVE record · CVSS 6.5 Medium · Not analysed yet · Published 30 Oct 2024 · Tags: Hard-coded credentials - [D-Link DSL6740C v6.TR069.20211230 was discovered to use insecure default credentials for Administrator access, possibly allowing attackers to bypass authentication and escalate privileges on the devi…](https://agentprime.io/advisories/CVE-2024-48271.md) `CVE-2024-48271` · CVE record · CVSS 8.8 High · Not analysed yet · Published 30 Oct 2024 · Tags: Hard-coded credentials - [IBM Flexible Service Processor hard coded credentials](https://agentprime.io/advisories/CVE-2024-45656.md) `CVE-2024-45656` · CVE record: IBM Flexible Service Processor · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 29 Oct 2024 · Tags: Hard-coded credentials - [Exposure of vSphere's CPI and CSI credentials in Rancher](https://agentprime.io/advisories/GHSA-xj7w-r753-vj8v.md) `GHSA-xj7w-r753-vj8v`, `CVE-2022-45157`, `GO-2024-3223` · Go `github.com/rancher/rancher`: affected `>=2.7.0, <2.8.9 || >=2.9.0, <2.9.3`, fixed in `2.8.9`, `2.9.3` · CVSS 8.5 High · Not analysed yet · Published 25 Oct 2024 · Tags: Hard-coded credentials - [OpenRefine leaks Google API credentials in releases](https://agentprime.io/advisories/GHSA-3pg4-qwc8-426r.md) `GHSA-3pg4-qwc8-426r` · Maven `org.openrefine:openrefine`: affected `<3.8.3`, fixed in `3.8.3` · No CVSS score · Not analysed yet · Published 24 Oct 2024 · Tags: Hard-coded credentials - [IBM Maximo Application Suite - Monitor Component information disclosure](https://agentprime.io/advisories/CVE-2024-38314.md) `CVE-2024-38314` · CVE record: IBM Maximo Application Suite - Monitor Component · CVSS 5.9 Medium · Not analysed yet · Published 24 Oct 2024 · Tags: Hard-coded credentials - [Neye3C v4.5.2.0 was discovered to contain a hardcoded encryption key in the firmware update mechanism.](https://agentprime.io/advisories/CVE-2024-48539.md) `CVE-2024-48539` · CVE record · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 24 Oct 2024 · Tags: Hard-coded credentials - [Hard-coded password in Cisco Firepower Threat Defense Software](https://agentprime.io/advisories/CVE-2024-20412.md) `CVE-2024-20412` · CVE record: Cisco Cisco Firepower Threat Defense Software · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 23 Oct 2024 · Tags: Hard-coded credentials - [Nexus Repository 3 - Static hard-coded encryption passphrase used by default](https://agentprime.io/advisories/CVE-2024-5764.md) `CVE-2024-5764` · CVE record: Sonatype Nexus Repository · CVSS 5.9 Medium · Not analysed yet · Published 23 Oct 2024 · Tags: Hard-coded credentials - [IBM CICS Transaction Gateway for Multiplatforms information disclosure](https://agentprime.io/advisories/CVE-2023-50310.md) `CVE-2023-50310` · CVE record: IBM CICS Transaction Gateway for Multiplatforms · CVSS 4.9 Medium · Not analysed yet · Published 23 Oct 2024 · Tags: Hard-coded credentials - [Kieback&Peter DDC4000 Series Use of Weak Credentials](https://agentprime.io/advisories/CVE-2024-43698.md) `CVE-2024-43698` · CVE record: Kieback&Peter DDC4040e and 4 more · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 22 Oct 2024 · Tags: Hard-coded credentials - [Kieback&Peter DDC4000 Series Path Traversal Insufficiently Protected Credentials](https://agentprime.io/advisories/CVE-2024-43812.md) `CVE-2024-43812` · CVE record: Kieback&Peter DDC4040e and 4 more · CVSS 8.6 High · Not analysed yet · Published 22 Oct 2024 · Tags: Hard-coded credentials - [Insufficiently protected credentials in Zyxel USG FLEX H series uOS firmware](https://agentprime.io/advisories/CVE-2024-9677.md) `CVE-2024-9677` · CVE record: Zyxel USG FLEX H series uOS firmware · CVSS 5.5 Medium · Not analysed yet · Published 22 Oct 2024 · Tags: Hard-coded credentials - [WordPress LiteSpeed Cache plugin < 6.5.0.1 - Unauthenticated Account Takeover via Cookie Leak vulnerability](https://agentprime.io/advisories/CVE-2024-44000.md) `CVE-2024-44000` · CVE record: LiteSpeed Technologies LiteSpeed Cache · CVSS 9.8 Critical · Critical (CVSS 9+, CVSS 7+ and EPSS) · EPSS 0.82 · Not analysed yet · Published 20 Oct 2024 · Tags: Hard-coded credentials - [MXsecurity Use of Hard-coded Credentials](https://agentprime.io/advisories/CVE-2024-4740.md) `CVE-2024-4740` · CVE record: Moxa MXsecurity Series · CVSS 5.3 Medium · Not analysed yet · Published 18 Oct 2024 · Tags: Hard-coded credentials - [HMS Networks EWON FLEXY 202 Insufficiently Protected Credentials](https://agentprime.io/advisories/CVE-2024-7755.md) `CVE-2024-7755` · CVE record: HMS Networks EWON FLEXY 202 · CVSS 7.1 High · Not analysed yet · Published 17 Oct 2024 · Tags: Hard-coded credentials - [Insufficiently Protected Credentials in Elvaco M-Bus Metering Gateway CMe3100](https://agentprime.io/advisories/CVE-2024-49396.md) `CVE-2024-49396` · CVE record: Elvaco M-Bus Metering Gateway CMe3100 · CVSS 8.7 High · Not analysed yet · Published 17 Oct 2024 · Tags: Hard-coded credentials - [VM images built with Image Builder and Proxmox provider use default credentials in github.com/kubernetes-sigs/image-builder](https://agentprime.io/advisories/GHSA-9224-ggvw-wh7v.md) `GHSA-9224-ggvw-wh7v`, `CVE-2024-9486`, `GO-2024-3203` · Go `github.com/kubernetes-sigs/image-builder`: affected `<0.1.38`, fixed in `0.1.38` · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 17 Oct 2024 · Tags: Hard-coded credentials Newest: Older: ## Filters and formats Filters are query parameters on this URL: `q` (words, as in a web search engine: `"a phrase"`, `OR`, `-word`; an id; a package or product name), `severity` (low, medium, high or critical), `critical=1`, `kev=1`, `ecosystem` (npm, pypi, packagist, go, maven, rubygems, crates, nuget, hex), `kind=package`, `assigner` (a CNA’s short name), `min_score` and `state`. Each record’s title links to its Markdown page. - The same list as JSON: - Every list: , critical: ; by weakness: and the other tags in ; by technology: `/advisories/technology/.md` (`fortinet-fortimail`) --- The web page: . Everything for agents: .