Advisories · Weakness
Hard-coded credentials.
Passwords and keys built into the code, or weak credentials. Every Advisory and CVE whose weakness (CWE) is one of these, newest first.
- CVSS 5.3 Medium
GE Reason RT43X Clocks Use of Hard-coded Cryptographic Key
- GE Reason RT43X Clocks
- Hard-coded credentials
- CVSS 5.3 Medium
Rockwell Automation ISaGRAF5 Runtime Use of Hard-coded Cryptographic Key
- Rockwell Automation ISaGRAF Runtime
- Hard-coded credentials
- CVSS 9.8 CriticalCritical · CVSS 9+
PTC Axeda agent and Axeda Desktop Server Use of Hard-Coded Credentials
- PTC Axeda agent
- PTC Axeda Desktop Server for Windows
- Hard-coded credentials
- CVSS 6.5 Medium
Passwords stored in plain text by Jenkins dbCharts Plugin
- Hard-coded credentials
<=0.5.2 · no fixed version yet
GHSA-x75r-g63m-82wj · CVE-2022-27216 - CVSS 3.3 Low
Client Secret stored in plain text by Jenkins GitLab Authentication Plugin
- Weak cryptography or TLS
- Hard-coded credentials
<1.14 · fixed in 1.14
GHSA-hx3r-qwxv-5jw9 · CVE-2022-27206 - CVSS 4.3 Medium
Passwords stored in plain text by Jenkins Vmware vRealize CodeStream Plugin
- Hard-coded credentials
<=1.2 · no fixed version yet
GHSA-9wvr-x83m-84v4 · CVE-2022-27217 - CVSS 4.3 Medium
Personal tokens stored in plain text by Jenkins incapptic connect uploader Plugin
- Hard-coded credentials
- CWE-256
<=1.15 · no fixed version yet
GHSA-8g9w-5jv6-7m4x · CVE-2022-27218 - CVSS 8.8 High
Hard coded credentials in FreeTAKServer
- Hard-coded credentials
<1.9.8.5 · fixed in 1.9.8.5
GHSA-f897-875p-23x7 · CVE-2022-25510 -
Hard-coded credentials in Yokogawa Electric Corporation CENTUM VP and others
- Yokogawa Electric Corporation CENTUM VP
- Yokogawa Electric Corporation Exaopc
- Hard-coded credentials
-
Hard-coded credentials in Yokogawa Electric Corporation CENTUM VP and others
- Yokogawa Electric Corporation CENTUM VP
- Yokogawa Electric Corporation Exaopc
- Hard-coded credentials
-
Insufficiently protected credentials in postgresql
- postgresql
- Hard-coded credentials
- CVSS 7.2 High
Use of Hard-coded Cryptographic Key in Netmaker
- Hard-coded credentials
<0.8.5 || >=0.9.0, <0.9.4 · fixed in 0.8.5, 0.9.4
GHSA-86f3-hf24-76q4 · CVE-2022-23650 - CVSS 4.3 Medium
Jenkins Pipeline: Groovy Plugin has Insufficiently Protected Credentials
- Weak cryptography or TLS
- Hard-coded credentials
<2656.vf7a_e7b_75a_457 · fixed in 2656.vf7a_e7b_75a_457
GHSA-qv6q-x9vr-w7j3 · CVE-2022-25180 - CVSS 4.3 Medium
Password parameter default values exposed by Jenkins Pipeline: Build Step Plugin
- Hard-coded credentials
<2.15.1 · fixed in 2.15.1
GHSA-g84f-cmc8-682c · CVE-2022-25184 - CVSS 6.5 Medium
Jenkins Support Core Plugin stores sensitive data in plain text
- Information disclosure
- Hard-coded credentials
<2.79.1 · fixed in 2.79.1
GHSA-5m8f-v3gw-h94w · CVE-2022-25187 - CVSS 6.4 Medium
containers/image library Insufficiently Protects Credentials
- Hard-coded credentials
<3.0.0 · fixed in 3.0.0
GHSA-85p9-j7c9-v4gr · CVE-2019-10214 - CVSS 8.0 High
BD Viper LT System - Hardcoded Credentials
- Becton Dickinson (BD) BD Viper LT System
- Hard-coded credentials
- CVSS 9.8 CriticalCritical · CVSS 9+
Incorrect handling of credential expiry by /nats-io/nats-server
- Hard-coded credentials
<1.1.0 · fixed in 1.1.0
GHSA-4w5x-x539-ppf5 · CVE-2020-26892 - CVSS 6.1 Medium
containerd v1.2.x can be coerced into leaking credentials during image pull
- Hard-coded credentials
<1.2.14 · fixed in 1.2.14
GHSA-742w-89gc-8m9c · CVE-2020-15157 - CVSS 7.0 High
BD Pyxis Products - Hardcoded Credentials
- Becton Dickinson (BD) BD Pyxis Anesthesia Station ES
- Becton Dickinson (BD) BD Pyxis Anesthesia Station 4000
- Hard-coded credentials
-
Insufficiently protected credentials in Conext� ComBox (All Versions)
- Conext� ComBox (All Versions)
- Hard-coded credentials
- CVSS 6.5 Medium
Insufficiently Protected Credentials in Reactor Netty
- Hard-coded credentials
>=0.9.0, <0.9.5 || >=0.8.0, <0.8.16 · fixed in 0.9.5, 0.8.16
GHSA-gpch-h32j-gx6x · CVE-2020-5404 - CVSS 4.7 Medium
GlobalProtect App: Insufficiently Protected Credentials Vulnerability on Linux
- Palo Alto Networks GlobalProtect App
- Hard-coded credentials
-
Hard-coded credentials in Easergy P40 Series model numbers with Ethernet option bit as Q, R…
- Easergy P40 Series model numbers with Ethernet option bit as Q, R, S (All PX4X firmware Versions)
- Hard-coded credentials
- CVSS 4.6 Medium
Insufficiently protected credentials in Intel(R) AMT SDK before version 16.0.3…
- Intel(R) AMT SDK before version 16.0.3, Intel(R) SCS before version 12.2 and Intel(R) MEBx
- Hard-coded credentials
-
Hard-coded credentials in Siemens SICAM TOOLBOX II
- Siemens SICAM TOOLBOX II
- Hard-coded credentials
-
Hard-coded credentials in Schneider Electric Easergy P5
- Schneider Electric Easergy P5
- Hard-coded credentials
- CVSS 9.8 CriticalCritical · CVSS 9+
Advantech ADAM-3600
- Advantech ADAM-3600
- Hard-coded credentials
- CVSS 6.5 Medium
Insufficiently Protected Credentials in Apache Superset
- Hard-coded credentials
<1.4.0 · fixed in 1.4.0
GHSA-hhm3-48h2-597v · CVE-2021-44451 - CVSS 7.5 High
Password exposure in ShenYu
- Hard-coded credentials
>=2.4.0, <2.4.2 · fixed in 2.4.2
GHSA-7wq4-89xx-g62j · CVE-2022-23223 - CVSS 7.5 High
An information disclosure vulnerability exists due to the hardcoded TLS key of reolink RLC-410W v3.0.0.136_20121102.
- Hard-coded credentials
- CVSS 6.3 Medium
Fresenius Kabi Agilia Connect Infusion System hard coded credentials
- Fresenius Kabi Vigilant Software Suite (Mastermed Dashboard)
- Hard-coded credentials
- CVSS 7.3 High
Fresenius Kabi Agilia Connect Infusion System insufficiently protected credentials
- Fresenius Kabi Agilia Link+
- Hard-coded credentials
- CVSS 5.5 Medium
MongoDB Extension for VS Code may unexpectedly store credentials locally in clear text
- MongoDB Inc. MongoDB for VS Code
- Hard-coded credentials
- CVSS 5.7 Medium
Use of Hard-coded Cryptographic Key
- Bosch AMS
- Bosch APE
- Hard-coded credentials
- CVSS 9.8 CriticalCritical · CVSS 9+
Le-yan Co., Ltd. dental management system - Hard-coded Credentials
- Le-yan Co., Ltd. Dental Management System
- Hard-coded credentials
- CVSS 5.5 Medium
Access key stored in plain text by Jenkins Metrics Plugin
- Hard-coded credentials
>=4.0.2.8, <4.0.2.8.1 || <4.0.2.7.1 · fixed in 4.0.2.8.1, 4.0.2.7.1
GHSA-gg9m-x3cg-69vh · CVE-2022-20621 - CVSS 6.5 Medium
Improper credentials masking in Jenkins HashiCorp Vault Plugin
- Hard-coded credentials
<3.8.0 · fixed in 3.8.0
GHSA-h6x7-jq46-fp33 · CVE-2022-23109 - CVSS 3.3 Low
Password stored in plain text by Jenkins Publish Over SSH Plugin
- Hard-coded credentials
<1.23 · fixed in 1.23
GHSA-r3rr-wph6-9638 · CVE-2022-23114 -
Hard-coded credentials in Siemens CP-8000 MASTER MODULE WITH I/O -25/+70°C and others
- Siemens CP-8000 MASTER MODULE WITH I/O -25/+70°C
- Siemens CP-8000 MASTER MODULE WITH I/O -40/+70°C
- Hard-coded credentials
- CVSS 9.1 CriticalCritical · CVSS 9+
Bot token exposed in main.py
- PuddingBot pudding-bot
- Hard-coded credentials
- CVSS 7.5 High
In Apache Kylin, Cross-origin requests with credentials are allowed to be sent from any origin.
- Hard-coded credentials
<3.1.3 || >=4.0.0, <4.0.1 · fixed in 3.1.3, 4.0.1
GHSA-mgpf-hhgf-cxg4 · CVE-2021-45457 - CVSS 7.5 High
Use of Hard-coded Credentials in Apache Kylin
- Weak cryptography or TLS
- Hard-coded credentials
<3.1.3 || >=4.0.0, <4.0.1 · fixed in 3.1.3, 4.0.1
GHSA-9fj5-jg6f-qg5r · CVE-2021-45458 - CVSS 7.5 High
Weak Password Requirements in Daybyday CRM
- Hard-coded credentials
>=1.1, <2.2.1 · fixed in 2.2.1
GHSA-96v6-hrwg-p378 · CVE-2022-22110 - CVSS 6.1 Medium
Philips Patient Information Center iX (PIC iX) and Efficia CM Series Use of Hard-coded Cryptographic Key
- Philips Patient Information Center iX (PIC iX)
- Hard-coded credentials
- CVSS 8.1 High
Philips IntelliBridge EC 40 and EC 80 Hub Use of Hard-coded Credentials
- Philips IntelliBridge EC 40 Hub
- Philips IntelliBridge EC 80 Hub
- Hard-coded credentials
- CVSS 6.8 Medium
Hard credentials discovered in SolarWinds Web Help Desk which allows to execute Arbitrary Hibernate Queries
- SolarWinds Web Help Desk
- Hard-coded credentials
- CVSS 8.1 HighCritical · KEV, CVSS 7+ and EPSSKEV
Acclaim USAHERDS through 7.4.0.1 uses hard-coded credentials.
- Hard-coded credentials
- CVSS 8.2 High
Hard-coded cryptographic key in Dell PowerPath Management Appliance
- Dell PowerPath Management Appliance
- Hard-coded credentials
- CVSS 7.5 High
Opencast publishes global system account credentials
- Information disclosure
- Hard-coded credentials
<10.6 · fixed in 10.6
GHSA-hcxx-mp6g-6gr9 · CVE-2018-16153 -
Insufficiently protected credentials in Siemens ModelSim Simulation and others
- Siemens ModelSim Simulation
- Siemens Questa Simulation
- Hard-coded credentials
- CVSS 9.0 CriticalCritical · CVSS 9+
Weak default credential associated with TCP port 26
- Hitachi Energy FOX61x
- Hitachi Energy XCM20
- Hard-coded credentials
- CVSS 8.1 High
HejHome IP Camera use of hard-coded credentials vulnerability
- Goqual GKW-IC052
- Hard-coded credentials
- CVSS 9.1 CriticalCritical · CVSS 9+
Hard-coded password in Dell CloudLink
- Dell CloudLink
- Hard-coded credentials
- CVSS 4.2 Medium
Insufficiently protected credentials in Motorola Binatone Hubble Cameras
- Motorola Binatone Hubble Cameras
- Hard-coded credentials
-
Insufficiently protected credentials in SAP SE SAP GUI for Windows
- SAP SE SAP GUI for Windows
- Hard-coded credentials
- CVSS 9.8 CriticalCritical · CVSS 9+
Cisco Policy Suite Static SSH Keys Vulnerability
- Cisco Policy Suite (CPS) Software
- Hard-coded credentials
- CVSS 8.2 High
AUVESY Versiondog
- AUVESY Versiondog
- Hard-coded credentials
- CVSS 9.8 CriticalCritical · CVSS 9+
InHand Networks IR615 Router
- InHand Networks IR615 Router
- Hard-coded credentials
- CVSS 9.8 CriticalCritical · CVSS 9+
Moxa MXview Network Management Software
- Moxa MXview Network Management Software
- Hard-coded credentials