Hard-coded credentials.

EVE Doesn't Protect Config Partition with Measured Boot

• Hard-coded credentials
• Information disclosure

<0.0.0-20230519072751-977f42b07fa9 · fixed in 0.0.0-20230519072751-977f42b07fa9

EVE's Debug Functions Unlockable Without Triggering Measured Boot

• Hard-coded credentials
• Information disclosure

<0.0.0-20220708121648-5fef4d92e758 · fixed in 0.0.0-20220708121648-5fef4d92e758

EVE: SSH as Root Unlockable Without Triggering Measured Boot

• Hard-coded credentials
• Information disclosure

<0.0.0-20220708121648-5fef4d92e758 · fixed in 0.0.0-20220708121648-5fef4d92e758

EVE Doesn't Measure Config Partition From 2 Fronts

• Weak cryptography or TLS
• Hard-coded credentials

<0.0.0-20230126065759-d9383a7ee4e1 · fixed in 0.0.0-20230126065759-d9383a7ee4e1

n8n's domain allowlist bypass enables credential exfiltration

• Hard-coded credentials
• CWE-20

<1.121.0 · fixed in 1.121.0

Cisco Prime Infrastructure Stored Cross-Site Scripting Vulnerability

• Cisco Prime Infrastructure
• Hard-coded credentials

Edimax EW-7438RPn 1.13 - Information Disclosure (WiFi Password)

• EDIMAX Technology Co., Ltd. EW-7438RPn Mini
• Hard-coded credentials

Netis E1+ 1.2.32533 - Backdoor Account (root)

• Netis Systems Co., Ltd. Netis E1+
• Hard-coded credentials

Skipper is vulnerable to arbitrary code execution through lua filters in github.com/zalando/skipper

• Code injection
• Privilege escalation

<0.23.0 · fixed in 0.23.0

Duplicate Advisory: FUXA contains a hard-coded credential vulnerability

• Hard-coded credentials

<=1.2.7 · no fixed version yet

HCL AION is affected by an Autocomplete HTML Attribute Not Disabled for Password Field vulnerability

• HCL AION
• Hard-coded credentials

Weak credentials in ELECOM CO.,LTD. WRC-X1500GS-B and others

• ELECOM CO.,LTD. WRC-X1500GS-B
• ELECOM CO.,LTD. WRC-X1500GSA-B
• Hard-coded credentials

Bambuddy Uses Hardcoded Secret Key + Many API Endpoints do not Require Authentication

• Authentication bypass
• Hard-coded credentials

<0.1.7 · fixed in 0.1.7

Hard-coded credentials in Samsung Electronics MagicINFO 9 Server

• Samsung Electronics MagicINFO 9 Server
• Hard-coded credentials

malcontent OCI image pull credential exfiltration via malicious registry token realm

• Hard-coded credentials

>=0.10.0, <1.20.3 · fixed in 1.20.3

Tenda AX12 Pro V2 Telnet Service hard-coded credentials

• Tenda AX12 Pro V2
• Hard-coded credentials

M/Monit 3.7.4 - Password Disclosure

• Tildeslash Ltd. M/Monit
• Hard-coded credentials

SolarWinds Web Help Desk Hardcoded Credentials Vulnerability

• SolarWinds Web Help Desk
• Hard-coded credentials

Dokploy uses hardcoded credentials in installation script, which could result in database access

• dokploy
• Hard-coded credentials

Use of well-known default credentials in EZCast Pro II Dongle

• EZCast Pro II
• Hard-coded credentials

Password Confirmation Bypass in Omada Controller

• TP-Link Systems Inc. Omada Controller
• Hard-coded credentials

Static Firmware Encryption Password in dormakaba access manager

• dormakaba Access Manager 92xx-k5
• Hard-coded credentials

Weak Default Passwords for SSH Access in dormakaba access manager

• dormakaba Access Manager 92xx-k5
• Hard-coded credentials

Weak Default Password in dormakaba Kaba exos 9300

• dormakaba Kaba exos 9300
• Hard-coded credentials

Hard-coded Key for PIN Encryption in dormakaba Kaba exos 9300

• dormakaba Kaba exos 9300
• Hard-coded credentials

Unauthenticated RPC Service in dormakaba Kaba exos 9300

• dormakaba Kaba exos 9300
• Hard-coded credentials

Hardcoded Legacy Accounts Allowing Control Over Access Managers in dormakaba Kaba exos 9300

• dormakaba Kaba exos 9300
• Hard-coded credentials

Beetel 777VR1 UART weak password

• Beetel 777VR1
• Hard-coded credentials

Hard-coded cryptographic key in Salesforce Marketing Cloud Engagement

• Salesforce Marketing Cloud Engagement
• Hard-coded credentials

Typebot affected by Credential Theft via Client-Side Script Execution and API Authorization Bypass

• Cross-site scripting (XSS)
• Information disclosure

<0.9.15 · fixed in 0.9.15

DataEase Vulnerable to Brute-Force Attack on Admin JWT Secret Derived from Password that Enables Full Account Takeover

• dataease
• Hard-coded credentials

Claude Code Leaks Data via Malicious Environment Configuration Before Trust Confirmation

• Hard-coded credentials

<2.0.65 · fixed in 2.0.65

Hard-Coded Default Credentials Enable Document Archive Decryption in Milner ImageDirector Capture

• Milner ImageDirector Capture
• Hard-coded credentials
• CWE-1392

Insufficient Configuration Protections Enable Database Credential Interception in Milner ImageDirector Capture

• Milner ImageDirector Capture
• Hard-coded credentials
• CWE-923

Insecure Masked Credential Fields Enable Database Credential Access in Milner ImageDirector Capture

• Milner ImageDirector Capture
• Hard-coded credentials

Hardcoded Encryption Key Enables Database Credential Access in Milner ImageDirector Capture

• Milner ImageDirector Capture
• Hard-coded credentials

IBM Sterling Connect:Direct for UNIX Container is affected by vulnerability where hard-coded credentials are embeeded in the product for its internal use.

• IBM Sterling Connect:Direct for UNIX Container
• Hard-coded credentials

BROWAN COMMUNICATIONS ｜PrismX MX100 AP controller - Insufficiently Protected Credentials

• BROWAN COMMUNICATIONS PrismX MX100 AP controller
• Hard-coded credentials

BROWAN COMMUNICATIONS ｜PrismX MX100 AP controller - Use of Hard-coded Credentials

• BROWAN COMMUNICATIONS PrismX MX100 AP controller
• Hard-coded credentials

HCL AION is affected by a Weak Password Policy vulnerability

• HCL Software AION
• Hard-coded credentials

DIAView - Authentication Bypass Vulnerability

• Delta Electronics DIAView
• Hard-coded credentials

MTPutty 1.0.1.21 - SSH Password Disclosure

• Ttyplus MTPutty
• Hard-coded credentials

Hard-coded credentials in SICK AG TDC-X401GL

• SICK AG TDC-X401GL
• Hard-coded credentials

Weak credentials in SICK AG TDC-X401GL

• SICK AG TDC-X401GL
• Hard-coded credentials

Plaintext Passwords Vulnerability in BLUVOYIX

• Bluspark Global BLUVOYIX
• Information disclosure
• Hard-coded credentials

Weak password requirements in Huawei HarmonyOS and others

• Huawei HarmonyOS
• Huawei EMUI
• Hard-coded credentials

Covenant 0.5 - Remote Code Execution (RCE)

• Cobbr Covenant
• Hard-coded credentials

fabricators Ltd Vanilla OS 2 Core image v1.1.0 was discovered to contain static keys for the SSH service, allowing attackers to possibly execute a man-in-the-middle attack during connections with oth…

• Hard-coded credentials

SQLE's JWT Secret Handler can be manipulated to use hard-coded cryptographic key in github.com/actiontech/sqle

• Hard-coded credentials
• CWE-320

* · no fixed version yet

Spectrum basic authentication in use

• Broadcom DX NetOps Spectrum
• Hard-coded credentials

An issue in Automai Director v.25.2.0 allows a remote attacker to escalate privileges and obtain sensitive information via a crafted js file

• Hard-coded credentials

Ruckus vRIoT IoT Controller < 3.0.0.0 Hardcoded SSH Credentials RCE

• RUCKUS Networks vRIoT IOT Controller
• Broken access control
• Hard-coded credentials

Ruckus vRIoT IoT Controller < 3.0.0.0 Hardcoded Tokens RCE

• RUCKUS Networks vRIoT IoT Controller
• Authentication bypass
• Hard-coded credentials

Hardcoded credentials in KAON CG3000T/CG3000CT routers

• KAON CG3000T
• KAON CG3000TC
• Hard-coded credentials

bearer token leak on cross-protocol redirect

• curl
• Hard-coded credentials

KAYSUS KS-WR3600 routers with firmware 1.0.5.9.1 enable the SSH service enabled by default on the LAN interface.

• Broken access control
• Authentication bypass

INIM Electronics Smartliving SmartLAN/G/SI <=6.x Hard-coded Credentials Vulnerability

• INIM Electronics s.r.l. Smartliving SmartLAN/G/SI
• Hard-coded credentials

FLIR Thermal Camera F/FC/PT/D firmware version 8.0.0.64 Hard-Coded SSH Credentials Vulnerability

• FLIR Systems, Inc. FLIR Thermal Camera F/FC/PT/D
• Hard-coded credentials

HCL DevOps Deploy is susceptible to insufficiently protected credentials

• HCLSoftware DevOps Deploy
• Hard-coded credentials

Adtec Digital SignEdje Digital Signage Player v2.08.28 Default Credentials

• Adtecdigital SignEdje Digital Signage Player
• Adtecdigital mediaHUB HD-Pro High & Standard Definition MPEG2 Encoder
• Hard-coded credentials
• CWE-1392