Hard-coded credentials.

Kubeflow Pipelines: Unauthenticated SSRF vulnerability in Kubeflow Pipelines TensorBoard proxy

• kubeflow pipelines
• Hard-coded credentials
• Server-side request forgery (SSRF)

BTCPay Server < 2.4.2 LND Macaroon Credential File Disclosure

• BTCPay Server
• Hard-coded credentials
• Information disclosure

langgenius dify Sandbox Run __init__.py hard-coded credentials

• langgenius dify
• Hard-coded credentials

kaniko can send the build's Azure (Entra ID) access token to lookalike ACR registry hosts

• Hard-coded credentials
• CWE-346

<1.25.20 · fixed in 1.25.20

Hard-coded cryptographic key in Trellix DLP on-prem extensions

• Trellix DLP on-prem extensions
• Hard-coded credentials

Apache OFBiz: Hard-coded Credentials in AdminServer Enable Unauthenticated Denial of Service

• Apache Software Foundation Apache OFBiz
• Hard-coded credentials

Apache OFBiz: Use of Hard-coded Cryptographic Key in JWT Token Authentication Enables Unauthenticated Administrative Access

• Apache Software Foundation Apache OFBiz
• Hard-coded credentials

Keycloak admin client secret stored in cleartext in a ConfigMap in Eclipse BaSyx Helm Charts

• Eclipse Foundation Eclipse BaSyx Helm Charts
• Information disclosure
• Hard-coded credentials

Keycloak admin user password stored in cleartext in a ConfigMap in Eclipse BaSyx Helm Charts

• Eclipse Foundation Eclipse BaSyx Helm Charts
• Information disclosure
• Hard-coded credentials

Apache Juneau: REST client forwards credentials to a different origin when following HTTP redirects

• Apache Software Foundation Apache Juneau
• Hard-coded credentials

VitaFit Cloud API Broken Access Control via S3 Token Endpoint

• Shenzhen Shine Industrial Co., Ltd. VitaFit
• Hard-coded credentials

VitaFit Android < 2.8.1.0 Hardcoded Credentials Disclosure

• Shenzhen Shine Industrial Co., Ltd. VitaFit
• Hard-coded credentials

Yuxi sandbox isolation failure allows cross-tenant access and internal service compromise

• xerrors Yuxi
• Command injection
• Broken access control

Nexus Repository 3 - Insufficiently Protected Credentials in Repository Signing Passphrase

• Sonatype Nexus Repository 3
• Hard-coded credentials

Nexus Repository 3 - Insufficiently Protected Credentials in YUM Repository Signing Key

• Sonatype Nexus Repository 3
• Hard-coded credentials

Symfony: ScopingHttpClient Sends the Credentials of Its Default Scope to Other Origins Through Network-Path References

• sensiolabs symfony
• Information disclosure
• Hard-coded credentials

Hardcoded Credentials Vulnerability in Tata Motors iRA and iRA.ev mobile application

• Tata Motors iRA 2.0
• Tata Motors iRA.ev
• Hard-coded credentials

Qihoo 360 Whole Home Router M5 Boot Script mpt start hard-coded credentials

• Qihoo 360 Whole Home Router M5
• Hard-coded credentials

Quest Foglight for Databases EncryptionUtil Hardcoded Encyption Key Local Privilege Escalation Vulnerability

• Quest Foglight for Databases
• Hard-coded credentials

Hard-coded cryptographic key in Dell OS Recovery tool

• Dell OS Recovery tool
• Hard-coded credentials

Password hash disclosure to "view only" admin users with custom user models

• Django
• Hard-coded credentials

Unauthenticated SSRF with MNESTIX_BACKEND_API_KEY disclosure in Eclipse Mnestix Browser server actions for configured Infrastructures

• Eclipse Foundation Eclipse Mnestix
• Hard-coded credentials
• Server-side request forgery (SSRF)

Attendo Admin Android 3.0.13 Hard-coded MQTT Broker Credentials

• Attendo (formerly Petpooja Payroll)
• Hard-coded credentials

AJ-Report through 1.7.1 Authentication Bypass leading to RCE via Share-Token

• anji-plus AJ-Report
• Hard-coded credentials

@sigstore/oci sends the registry Authorization header to a cross-host blob-upload Location

• Hard-coded credentials

<0.7.2 · fixed in 0.7.2

pgAdmin 4: Materialized view refresh redirects its connection through a crafted database name

• pgadmin.org pgAdmin 4
• Command injection
• Hard-coded credentials

pgAdmin 4: libpq uses the pgAdmin service account's own password file and client certificate

• pgadmin.org pgAdmin 4
• Hard-coded credentials
• CWE-1188

pgAdmin 4: Connection services are not restricted in server mode

• pgadmin.org pgAdmin 4
• Hard-coded credentials
• Broken access control

pgAdmin 4: libpq uses the pgAdmin service account's Kerberos credentials

• pgadmin.org pgAdmin 4
• Hard-coded credentials
• CWE-1188

pgAdmin 4: SSH tunnels use the pgAdmin service account's own SSH identity

• pgadmin.org pgAdmin 4
• Hard-coded credentials
• CWE-1188

WIT SynApps Runtime 1.4.11 Hardcoded OAuth Credentials Disclosure

• WIT SynApps Runtime
• Hard-coded credentials

ng-antd-admin: Hardcoded JWT Secret allows Authentication Bypass in ng-antd-admin

• huajian123 ng-antd-admin
• Hard-coded credentials

SOCFortress CoPilot: Unauthenticated Exposure of ScoutSuite Reports and Uploaded GCP Service-Account Key via Static Mount

• socfortress CoPilot
• Information disclosure
• Authentication bypass

SOCFortress CoPilot: Hardcoded Default Header Secret - Unauthenticated Active-Response Invocation and Alert Injection

• socfortress CoPilot
• Authentication bypass
• Hard-coded credentials

Songloft 2.9.0 before 2.13.6 Hardcoded Admin Credentials in Embedded Backend

• songloft
• Hard-coded credentials

Hard-coded cryptographic key in Dell OpenManage Enterprise

• Dell OpenManage Enterprise
• Hard-coded credentials

OpenDeepWiki through 2.0.6 Hard-coded JWT Signing Key Admin Token Forgery

• AIDotNet OpenDeepWiki
• Hard-coded credentials

Insufficiently protected credentials in Dell OpenManage Enterprise

• Dell OpenManage Enterprise
• Hard-coded credentials

Prometheus through 3.15.1 Credential Leak via remote_write Cross-Host Redirects

• prometheus
• Hard-coded credentials

Password Disclosure via Activity Logs Enabling Administrator Privilege Escalation in WS_FTP Server

• Progress Software WS_FTP Server
• Hard-coded credentials
• Information disclosure

Improper Authentication in Progress WS_FTP Server

• Progress Software WS_FTP Server
• Authentication bypass
• Hard-coded credentials

Langflow OSS is affected by multiple vulnerabilities

• IBM Langflow OSS
• Hard-coded credentials

Langflow OSS is affected by multiple vulnerabilities

• IBM Langflow OSS
• Hard-coded credentials

Hardcoded API Token in Foxit Official Website

• Foxit Software Inc. foxit.com
• Hard-coded credentials

Hard-coded Cryptographic Key #2

• QNAP Systems Inc. HBS 3 Hybrid Backup Sync
• QNAP Systems Inc. Hybrid Backup Sync
• Hard-coded credentials

Hard-coded Cryptographic Key #1

• QNAP Systems Inc. HBS 3 Hybrid Backup Sync
• QNAP Systems Inc. Hybrid Backup Sync
• Hard-coded credentials

Alpine iLX-F511 SSH Hard-Coded Credentials Remote Code Execution Vulnerability

• Alpine iLX-F511
• Hard-coded credentials

Azure Monitor access token disclosure via SSRF

• Grafana Enterprise
• Grafana OSS
• Hard-coded credentials
• Server-side request forgery (SSRF)

Insufficiently protected credentials in Acronis Cyber Protect 17

• Acronis Cyber Protect 17
• Hard-coded credentials

Hard-coded cryptographic key in Dell PowerProtect Data Domain

• Dell PowerProtect Data Domain
• Hard-coded credentials

Insufficiently protected credentials in EagleCloud Aquila on-premises version

• EagleCloud Aquila
• Hard-coded credentials

CTFer.io's CTFd Terraform Provider allows a local or remote attacker to read team passwords in state as non sensitive values

• Hard-coded credentials

>=0.1.5, <=1.1.0 · no fixed version yet

Hardcoded AES-128 Key and Fixed IV in Configuration Backup Encryption in TP-Link RE305 and Archer C7

• TP-Link Systems Inc. RE305 v3
• TP-Link Systems Inc. Archer C7 v5
• Hard-coded credentials

Authlib accepts an empty HMAC key, allowing JWS/JWT signature forgery (HS256/HS384/HS512)

• Authentication bypass
• Weak cryptography or TLS

<1.9.1 · fixed in 1.9.1

nest-admin before 1.0.1 Authentication Bypass via Hardcoded JWT Secret

• buqiyuan nest-admin
• Hard-coded credentials

Weak password requirements in Eaton easyE4

• Eaton easyE4
• Hard-coded credentials

Supermicro BMC contains a SMCRAKP Fixed Key vulnerability

• SMCI X12SPI
• Hard-coded credentials

Security Advisory for offline recovery of Symantec GSS 3.3 RU11 stored domain credentials

• Broadcom Symantec Ghost Solution Suite
• Hard-coded credentials

Static HTTPS private key and CA private key in firmware in OnCell G3150A-LTE Series

• Moxa OnCell G3150A-LTE Series
• Hard-coded credentials

Kener 3.0.0 before 4.1.10 Authentication Bypass via Hardcoded Fallback JWT Secret

• rajnandan1 kener
• Hard-coded credentials