Advisories · Weakness
Hard-coded credentials.
Passwords and keys built into the code, or weak credentials. Every Advisory and CVE whose weakness (CWE) is one of these, newest first.
- CVSS 7.8 High
Jenkins Build-Publisher plugin has Insufficiently Protected Credentials
- Hard-coded credentials
<1.22 · fixed in 1.22
GHSA-m3wv-fr8v-fmh7 · CVE-2017-1000387 - CVSS 9.8 CriticalCritical · CVSS 9+
Jenkins SSH Plugin user passwords for encrypted SSH keys stored in plaintext
- Hard-coded credentials
<2.5 · fixed in 2.5
GHSA-5gmf-8gh2-hhfp · CVE-2017-1000245 - CVSS 5.3 Medium
Improper Privilege Management in X-Pack
- Privilege escalation
- Hard-coded credentials
<5.5.2 · fixed in 5.5.2
GHSA-m728-qvxh-xfjq · CVE-2017-8446 - CVSS 4.0, no score published
Jenkins allows Administrators to Access API Tokens
- Hard-coded credentials
<1.625.2 || >=1.626, <1.638 · fixed in 1.625.2, 1.638
GHSA-x4m5-j4x4-4wjg · CVE-2015-5323 - CVSS 7.5 High
OpenStack Identity Keystone and keystonemiddleware Insufficiently Protected Credentials
- Hard-coded credentials
>=8.0, <8.1.0 || >=9.0.0.0b1, <9.0.0.0b2 · fixed in 8.1.0, 9.0.0.0b2
GHSA-8c4w-v65p-jvcv · CVE-2015-7546 - CVSS 6.5 Medium
Jenkins Crowd Integration Plugin stores credentials in plain text
- Hard-coded credentials
<=1.2 · no fixed version yet
GHSA-r5jr-82x4-r6j7 · CVE-2019-1003097 - CVSS 6.5 Medium
Jenkins TestFairy Plugin stores credentials in plain text
- Hard-coded credentials
<4.17.2 · fixed in 4.17.2
GHSA-ffv8-x822-fx73 · CVE-2019-1003096 - CVSS 9.8 CriticalCritical · CVSS 9+
TeamPass Storing Passwords in a Recoverable Format vulnerability
- Hard-coded credentials
<=2.1.27 · no fixed version yet
GHSA-q9qr-h33g-fw3j · CVE-2019-1000001 - CVSS 7.8 High
Jenkins Artifactory Plugin stored old directly entered credentials unencrypted on disk
- Hard-coded credentials
<2.16.2 · fixed in 2.16.2
GHSA-cvh8-9j4x-5v4j · CVE-2018-1000424 - CVSS 7.8 High
Jenkins Crowd 2 Integration Plugin stored credentials in plain text
- Hard-coded credentials
<2.0.1 · fixed in 2.0.1
GHSA-cg6q-gp23-vwx8 · CVE-2018-1000423 - CVSS 7.8 High
Jenkins SonarQube Scanner Plugin stored server authentication token in plain text
- Hard-coded credentials
<2.8.1 · fixed in 2.8.1
GHSA-3ccq-gccx-pm7j · CVE-2018-1000425 - CVSS 4.3 Medium
Jenkins AppDynamics Dashboard Plugin has insufficiently protected credentials
- Hard-coded credentials
<1.0.15 · fixed in 1.0.15
GHSA-mmqx-g78c-hvfj · CVE-2019-1003039 - CVSS 6.5 Medium
ECS Publisher Plugin stored and displayed API token in plain text
- Hard-coded credentials
<1.0.1 · fixed in 1.0.1
GHSA-ffj8-w4rj-vr7v · CVE-2019-1003045 - CVSS 3.3 Low
Jenkins Repository Connector Plugin has insufficiently protected credentials
- Hard-coded credentials
<1.2.5 · fixed in 1.2.5
GHSA-99jc-v8pq-6qm4 · CVE-2019-1003038 - CVSS 3.3 Low
Jenkins Jabber Server Plugin stores credentials in plain text
- Hard-coded credentials
<=1.9 · no fixed version yet
GHSA-cc7j-xx7q-fr34 · CVE-2019-10288 - CVSS 3.3 Low
Jenkins youtrack-plugin Plugin stored credentials in plain text
- Hard-coded credentials
<0.7.2 · fixed in 0.7.2
GHSA-c7p6-x2p3-3wph · CVE-2019-10287 - CVSS 4.3 Medium
Jenkins Diawi Upload Plugin stores credentials in plain text
- Hard-coded credentials
<=1.4 · no fixed version yet
GHSA-ph9f-h462-j5jg · CVE-2019-10284 - CVSS 4.3 Medium
Jenkins mabl Plugin stores credentials in plain text
- Hard-coded credentials
<0.0.13 · fixed in 0.0.13
GHSA-hmf2-prm5-rvxm · CVE-2019-10283 - CVSS 4.3 Medium
Jenkins DeployHub Plugin stores credentials in plain text
- Hard-coded credentials
<8.0.14 · fixed in 8.0.14
GHSA-9m3c-xfhf-53mh · CVE-2019-10286 - CVSS 3.3 Low
Jenkins Minio Storage Plugin stores credentials in plain text
- Hard-coded credentials
<=0.0.3 · no fixed version yet
GHSA-55f8-m8w5-fmq8 · CVE-2019-10285 - CVSS 3.3 Low
Jenkins Koji Plugin stores credentials in plain text
- Hard-coded credentials
<=0.3 · no fixed version yet
GHSA-x464-r7f4-gj3m · CVE-2019-10298 - CVSS 3.3 Low
Jenkins Netsparker Enterprise Scan Plugin stored credentials in plain text
- Hard-coded credentials
<1.1.6 · fixed in 1.1.6
GHSA-m7q8-8g56-m78w · CVE-2019-10291 - CVSS 3.3 Low
Jenkins Sametime Plugin stores credentials in plain text
- Hard-coded credentials
<=0.4 · no fixed version yet
GHSA-jvr5-r663-qxgw · CVE-2019-10297 - CVSS 3.3 Low
Jenkins CloudCoreo DeployTime Plugin stores credentials in plain text
- Hard-coded credentials
<=0.2.3 · no fixed version yet
GHSA-7hf6-hggp-vvp9 · CVE-2019-10299 - CVSS 3.3 Low
Jenkins Serena SRA Deploy Plugin stores credentials in plain text
- Hard-coded credentials
<=1.4.2.4 · no fixed version yet
GHSA-rwrx-hrf2-v577 · CVE-2019-10296 - CVSS 4.3 Medium
Jenkins crittercism-dsym Plugin stores API key in plain text
- Hard-coded credentials
<=1.1 · no fixed version yet
GHSA-pxgr-rc8g-pj7r · CVE-2019-10295 - CVSS 8.8 High
Jenkins StarTeam Plugin stores credentials in plain text
- Hard-coded credentials
<=0.6.13 · no fixed version yet
GHSA-gvhp-v4m2-3rwf · CVE-2019-10277 - CVSS 4.3 Medium
Jenkins Klaros-Testmanagement Plugin stores credentials in plain text
- Hard-coded credentials
<2.1.0 · fixed in 2.1.0
GHSA-cr98-64h9-g8cg · CVE-2019-10282 - CVSS 3.3 Low
Jenkins Relution Enterprise Appstore Publisher Plugin stores credentials in plain text
- Hard-coded credentials
<=1.24 · no fixed version yet
GHSA-9fpq-v2p3-w63j · CVE-2019-10281 - CVSS 8.8 High
Jenkins Kmap Plugin stores credentials in plain text
- Hard-coded credentials
=1.6 · no fixed version yet
GHSA-746x-xxrx-23jp · CVE-2019-10294 - CVSS 8.8 High
Jenkins Assembla Auth Plugin stores credentials in plain text
- Hard-coded credentials
<1.13 · fixed in 1.13
GHSA-wmq3-24jm-m8xh · CVE-2019-10280 -
Moodle Temporary Passwords are Brute Force-able
- Hard-coded credentials
>=2.5.0, <2.5.9 || >=2.6.0, <2.6.6 || >=2.7.0, <2.7.3 · fixed in 2.5.9, 2.6.6, 2.7.3
GHSA-9v64-447r-wch6 · CVE-2014-7845 - CVSS 4.3 Medium
Hard-coded password in InHand Networks InRouter302
- InHand Networks InRouter302
- Hard-coded credentials
- CVSS 6.3 Medium
Hard-coded cryptographic key in InHand Networks InRouter302
- InHand Networks InRouter302
- Hard-coded credentials
- CVSS 7.3 High
Exposure of repository credentials to external third-party sources in Rancher
- Information disclosure
- Hard-coded credentials
>=2.5.0, <2.5.12 || >=2.6.0, <2.6.3 · fixed in 2.5.12, 2.6.3
GHSA-4fc7-hc63-7fjg · CVE-2021-36778 - CVSS 9.8 CriticalCritical · CVSS 9+
Bender Charge Controller: Hardcoded Credentials in Charge Controller
- Bender / ebee CC612
- Bender / ebee CC613
- Hard-coded credentials
- CVSS 7.5 High
Apache Doris, prior to 1.0.0, used a hardcoded key and IV to initialize the cipher used for ldap password, which may lead to information disclosure.
- Hard-coded credentials
<1.0.0 · fixed in 1.0.0
GHSA-98j2-hfxp-8h8r · CVE-2022-23942 - CVSS 7.3 High
ASUS WebStorage - Use of Hard-coded Credentials
- ASUS WebStorage
- Hard-coded credentials
- CVSS 8.2 High
Insufficiently protected credentials in Dell Repository Manager (DRM)
- Dell Repository Manager (DRM)
- Hard-coded credentials
- CVSS 7.5 High
Cisco Umbrella Virtual Appliance Static SSH Host Key Vulnerability
- Cisco Umbrella Insights Virtual Appliance
- Hard-coded credentials
- CVSS 9.6 CriticalCritical · CVSS 9+
ICSA-22-104-03 Red Lion DA50N
- Red Lion DA50N
- Hard-coded credentials
- CVSS 4.6 Medium
ICSA-22-104-03 Red Lion DA50N
- Red Lion DA50N
- Hard-coded credentials
- CVSS 7.4 High
Databasir 1.01 has Use of Hard-coded Cryptographic Key vulnerability.
- vran-dev databasir
- Hard-coded credentials
-
Insufficiently protected credentials in ansible
- ansible
- Hard-coded credentials
- CVSS 6.8 MediumCritical · KEVKEV
Zoho ManageEngine ADSelfService Plus before build 6122 allows a remote authenticated administrator to execute arbitrary operating OS commands as SYSTEM via the policy custom script feature.
- Hard-coded credentials
- CVSS 3.3 Low
B. Braun SpaceCom, Battery Pack SP with Wi-Fi, and Data module compactplus
- B. Braun Melsungen AG SpaceCom
- B. Braun Melsungen AG Battery pack with Wi-Fi
- Hard-coded credentials
- CVSS 10.0 CriticalCritical · CVSS 9+
Hard-coded credentials in Swift Sensors Gateway
- Swift Sensors Gateway
- Hard-coded credentials
- CVSS 10.0 CriticalCritical · CVSS 9+
Hard-coded credentials in Moxa MXView Series
- Moxa MXView Series
- Hard-coded credentials
-
Hard-coded credentials in Citirx Citrix SD-WAN
- Citirx Citrix SD-WAN
- Hard-coded credentials
- CVSS 4.3 Medium
Private key stored in plain text by Jenkins Google Compute Engine Plugin
- Hard-coded credentials
<4.3.9 · fixed in 4.3.9
GHSA-vhxq-9mpv-gj87 · CVE-2022-29052 - CVSS 7.1 High
Hard-coded credentials in Dell PowerScale OneFS
- Dell PowerScale OneFS
- Hard-coded credentials
- CVSS 7.3 High
TAIWAN SECOM CO., LTD., a xDoor Access Control and Personnel Attendance Management system - Hard-coded Credentials
- TAIWAN SECOM CO., LTD., Personnel Attendance Management system
- Hard-coded credentials
- CVSS 4.3 Medium
Weak Password Requirements in weseek/growi
- weseek/growi
- Hard-coded credentials
- CVSS 8.6 HighCritical · CVSS 7+ and EPSS
Kyocera Net View Address Book Exposure
- Kyocera Multifunction Printer Net Viewer
- Hard-coded credentials
- CVSS 3.7 Low
Philips Vue PACS Insufficiently Protected Credentials
- Philips Vue PACS
- Philips Vue MyVue
- Hard-coded credentials
- CVSS 6.5 Medium
Password stored in plain text by Jenkins Proxmox Plugin
- Hard-coded credentials
<0.6.0 · fixed in 0.6.0
GHSA-w97x-j6rg-55v5 · CVE-2022-28141 - CVSS 6.5 Medium
Plaintext storage in Jenkins instant-messaging Plugin
- Hard-coded credentials
- CWE-256
<1.42 · fixed in 1.42
GHSA-hpm9-fx8v-w45v · CVE-2022-28135 - CVSS 8.4 High
GE UR family hardcoded credentials
- GE UR bootloader binary
- Hard-coded credentials
- CVSS 3.1 Low
ePO password change vulnerability
- McAfee,LLC McAfee ePolicy Orchestrator (ePO)
- Hard-coded credentials
- CVSS 6.5 Medium
ePO database restoration vulnerability
- McAfee,LLC McAfee ePolicy Orchestrator (ePO)
- Hard-coded credentials