CVEdetails.com the ultimate security vulnerability data source
(e.g.: CVE-2009-1234 or 2010-1234 or 20101234)
Log In   Register
  What's the CVSS score of your company?
Vulnerability Feeds & WidgetsNew   www.itsecdb.com  

Security Vulnerabilities Related To CWE-798

Press ESC to close
# CVE ID CWE ID # of Exploits Vulnerability Type(s) Publish Date Update Date Score Gained Access Level Access Complexity Authentication Conf. Integ. Avail.
301 CVE-2019-16207 798 +Priv 2019-11-08 2019-11-09
4.6
None Local Low Not required Partial Partial Partial
Brocade SANnav versions before v2.0 use a hard-coded password, which could allow local authenticated attackers to access a back-end database and gain privileges.
302 CVE-2019-16153 798 2020-01-23 2020-01-27
7.5
None Remote Low Not required Partial Partial Partial
A hard-coded password vulnerability in the Fortinet FortiSIEM database component version 5.2.5 and below may allow attackers to access the device database via the use of static credentials.
303 CVE-2019-16150 798 2020-06-04 2020-06-09
5.0
None Remote Low Not required Partial None None
Use of a hard-coded cryptographic key to encrypt security sensitive data in local storage and configuration in FortiClient for Windows prior to 6.4.0 may allow an attacker with access to the local storage or the configuration backup file to decrypt the sensitive data via knowledge of the hard-coded key.
304 CVE-2019-15977 798 Bypass 2020-01-06 2020-02-06
7.8
None Remote Low Not required Complete None None
Multiple vulnerabilities in the authentication mechanisms of Cisco Data Center Network Manager (DCNM) could allow an unauthenticated, remote attacker to bypass authentication and execute arbitrary actions with administrative privileges on an affected device. For more information about these vulnerabilities, see the Details section of this advisory.
305 CVE-2019-15976 798 Bypass 2020-01-06 2020-02-06
10.0
None Remote Low Not required Complete Complete Complete
Multiple vulnerabilities in the authentication mechanisms of Cisco Data Center Network Manager (DCNM) could allow an unauthenticated, remote attacker to bypass authentication and execute arbitrary actions with administrative privileges on an affected device. For more information about these vulnerabilities, see the Details section of this advisory.
306 CVE-2019-15975 798 Bypass 2020-01-06 2020-02-06
10.0
None Remote Low Not required Complete Complete Complete
Multiple vulnerabilities in the authentication mechanisms of Cisco Data Center Network Manager (DCNM) could allow an unauthenticated, remote attacker to bypass authentication and execute arbitrary actions with administrative privileges on an affected device. For more information about these vulnerabilities, see the Details section of this advisory.
307 CVE-2019-15867 798 2019-09-03 2019-09-06
6.5
None Remote Low ??? Partial Partial Partial
The slick-popup plugin before 1.7.2 for WordPress has a hardcoded OmakPass13# password for the slickpopupteam account, after a Subscriber calls a certain AJAX action.
308 CVE-2019-15802 798 2019-11-14 2019-11-22
4.3
None Remote Medium Not required Partial None None
An issue was discovered on Zyxel GS1900 devices with firmware before 2.50(AAHH.0)C0. The firmware hashes and encrypts passwords using a hardcoded cryptographic key in sal_util_str_encrypt() in libsal.so.0.0. The parameters (salt, IV, and key data) are used to encrypt and decrypt all passwords using AES256 in CBC mode. With the parameters known, all previously encrypted passwords can be decrypted. This includes the passwords that are part of configuration backups or otherwise embedded as part of the firmware.
309 CVE-2019-15745 798 2019-08-29 2019-09-05
3.3
None Local Network Low Not required Partial None None
The Eques elf smart plug and the mobile app use a hardcoded AES 256 bit key to encrypt the commands and responses between the device and the app. The communication happens over UDP port 27431. An attacker on the local network can use the same key to encrypt and send commands to discover all smart plugs in a network, take over control of a device, and perform actions such as turning it on and off.
310 CVE-2019-15497 798 2019-08-26 2019-09-04
10.0
None Remote Low Not required Complete Complete Complete
Black Box iCOMPEL 9.2.3 through 11.1.4, as used in ONELAN Net-Top-Box 9.2.3 through 11.1.4 and other products, has default credentials that allow remote attackers to access devices remotely via SSH, HTTP, HTTPS, and FTP.
311 CVE-2019-15017 798 2019-10-09 2020-02-17
7.2
None Local Low Not required Complete Complete Complete
The SSH service is enabled on the Zingbox Inspector versions 1.294 and earlier, exposing SSH to the local network. When combined with PAN-SA-2019-0027, this can allow an attacker to authenticate to the service using hardcoded credentials.
312 CVE-2019-15015 798 2019-10-09 2020-02-17
7.2
None Local Low Not required Complete Complete Complete
In the Zingbox Inspector, versions 1.294 and earlier, hardcoded credentials for root and inspector user accounts are present in the system software, which can result in unauthorized users gaining access to the system.
313 CVE-2019-14943 798 2019-08-29 2019-09-04
7.5
None Remote Low Not required Partial Partial Partial
An issue was discovered in GitLab Community and Enterprise Edition 12.0 through 12.1.4. It uses Hard-coded Credentials.
314 CVE-2019-14930 798 +Priv 2019-10-28 2019-10-30
10.0
None Remote Low Not required Complete Complete Complete
An issue was discovered on Mitsubishi Electric ME-RTU devices through 2.02 and INEA ME-RTU devices through 3.0. Undocumented hard-coded user passwords for root, ineaadmin, mitsadmin, and maint could allow an attacker to gain unauthorised access to the RTU. (Also, the accounts ineaadmin and mitsadmin are able to escalate privileges to root without supplying a password due to insecure entries in /etc/sudoers on the RTU.)
315 CVE-2019-14926 798 2019-10-28 2019-10-30
7.5
None Remote Low Not required Partial Partial Partial
An issue was discovered on Mitsubishi Electric ME-RTU devices through 2.02 and INEA ME-RTU devices through 3.0. Hard-coded SSH keys allow an attacker to gain unauthorised access or disclose encrypted data on the RTU due to the keys not being regenerated on initial installation or with firmware updates. In other words, these devices use private-key values in /etc/ssh/ssh_host_rsa_key, /etc/ssh/ssh_host_ecdsa_key, and /etc/ssh/ssh_host_dsa_key files that are publicly available from the vendor web sites.
316 CVE-2019-14919 798 Exec Code +Priv 2020-01-09 2020-01-21
7.2
None Local Low Not required Complete Complete Complete
An exposed Telnet Service on the Billion Smart Energy Router SG600R2 with firmware v3.02.rc6 allows a local network attacker to authenticate via hardcoded credentials into a shell, gaining root execution privileges over the device.
317 CVE-2019-14837 798 2020-01-07 2020-01-15
6.4
None Remote Low Not required Partial Partial None
A flaw was found in keycloack before version 8.0.0. The owner of 'placeholder.org' domain can setup mail server on this domain and knowing only name of a client can reset password and then log in. For example, for client name 'test' the email address will be 'service-account-test@placeholder.org'.
318 CVE-2019-14482 798 2020-12-16 2020-12-17
10.0
None Remote Low Not required Complete Complete Complete
AdRem NetCrunch 10.6.0.4587 has a hardcoded SSL private key vulnerability in the NetCrunch web client. The same hardcoded SSL private key is used across different customers' installations when no other SSL certificate is installed, which allows remote attackers to defeat cryptographic protection mechanisms by leveraging knowledge of this key from another installation.
319 CVE-2019-14309 798 2020-03-13 2020-03-18
5.0
None Remote Low Not required Partial None None
Ricoh SP C250DN 1.05 devices have a fixed password. FTP service credential were found to be hardcoded within the printer firmware. This would allow to an attacker to access and read information stored on the shared FTP folders.
320 CVE-2019-13658 798 Exec Code 2019-10-02 2021-04-09
7.5
None Remote Low Not required Partial Partial Partial
CA Network Flow Analysis 9.x and 10.0.x have a default credential vulnerability that can allow a remote attacker to execute arbitrary commands and compromise system security.
321 CVE-2019-13657 798 Exec Code 2019-10-17 2019-10-24
6.5
None Remote Low ??? Partial Partial Partial
CA Performance Management 3.5.x, 3.6.x before 3.6.9, and 3.7.x before 3.7.4 have a default credential vulnerability that can allow a remote attacker to execute arbitrary commands and compromise system security.
322 CVE-2019-13559 798 2020-04-07 2020-04-08
7.2
None Local Low Not required Complete Complete Complete
GE Mark VIe Controller is shipped with pre-configured hard-coded credentials that may allow root-user access to the controller. A limited application of the affected product may ship without setup and configuration instructions immediately available to the end user. The bulk of controllers go into applications requiring the GE commissioning engineer to change default configurations during the installation process. GE recommends that users reset controller passwords during installation in the operating environment.
323 CVE-2019-13553 798 2019-10-25 2020-02-10
10.0
None Remote Low Not required Complete Complete Complete
Rittal Chiller SK 3232-Series web interface as built upon Carel pCOWeb firmware A1.5.3 – B1.2.4. The authentication mechanism on affected systems is configured using hard-coded credentials. These credentials could allow attackers to influence the primary operations of the affected systems, namely turning the cooling unit on and off and setting the temperature set point.
324 CVE-2019-13543 798 2019-11-08 2019-11-13
5.0
None Remote Low Not required Partial None None
Medtronic Valleylab Exchange Client version 3.4 and below, Valleylab FT10 Energy Platform (VLFT10GEN) software version 4.0.0 and below, and Valleylab FX8 Energy Platform (VLFX8GEN) software version 1.1.0 and below use multiple sets of hard-coded credentials. If discovered, they can be used to read files on the device.
325 CVE-2019-13530 798 2019-09-12 2019-10-09
6.5
None Remote Low ??? Partial Partial Partial
Philips IntelliVue WLAN, portable patient monitors, WLAN Version A, Firmware A.03.09, WLAN Version A, Firmware A.03.09, Part #: M8096-67501, WLAN Version B, Firmware A.01.09, Part #: N/A (Replaced by Version C) and WLAN Version B, Firmware A.01.09, Part #: N/A (Replaced by Version C). An attacker can use these credentials to login via ftp and upload a malicious firmware.
326 CVE-2019-13474 798 2019-09-16 2020-08-24
7.5
None Remote Low Not required Partial Partial Partial
TELESTAR Bobs Rock Radio, Dabman D10, Dabman i30 Stereo, Imperial i110, Imperial i150, Imperial i200, Imperial i200-cd, Imperial i400, Imperial i450, Imperial i500-bt, and Imperial i600 TN81HH96-g102h-g102 devices have insufficient access control for the /set_dname, /mylogo, /LocalPlay, /irdevice.xml, /Sendkey, /setvol, /hotkeylist, /init, /playlogo.jpg, /stop, /exit, /back, and /playinfo commands.
327 CVE-2019-13473 798 2019-09-11 2020-08-27
10.0
None Remote Low Not required Complete Complete Complete
TELESTAR Bobs Rock Radio, Dabman D10, Dabman i30 Stereo, Imperial i110, Imperial i150, Imperial i200, Imperial i200-cd, Imperial i400, Imperial i450, Imperial i500-bt, and Imperial i600 TN81HH96-g102h-g102 devices have an undocumented TELNET service within the BusyBox subsystem, leading to root access.
328 CVE-2019-13466 798 2019-09-30 2020-08-24
5.0
None Remote Low Not required Partial None None
Western Digital SSD Dashboard before 2.5.1.0 and SanDisk SSD Dashboard before 2.5.1.0 have Incorrect Access Control. The “generate reports” archive is protected with a hard-coded password. An application update that addresses the protection of archive encryption is available.
329 CVE-2019-13399 798 2019-07-08 2019-07-09
4.3
None Remote Medium Not required Partial None None
Dynacolor FCM-MB40 v1.2.0.0 devices have a hard-coded SSL/TLS key that is used during an administrator's SSL conversation.
330 CVE-2019-13352 798 2019-07-05 2019-07-15
10.0
None Remote Low Not required Complete Complete Complete
WolfVision Cynap before 1.30j uses a static, hard-coded cryptographic secret for generating support PINs for the 'forgot password' feature. By knowing this static secret and the corresponding algorithm for calculating support PINs, an attacker can reset the ADMIN password and thus gain remote access.
331 CVE-2019-12920 798 2019-06-20 2019-06-27
10.0
None Remote Low Not required Complete Complete Complete
On Shenzhen Cylan Clever Dog Smart Camera DOG-2W and DOG-2W-V4 devices, an attacker on the network can login remotely to the camera and gain root access. The device ships with a hardcoded 12345678 password for the root account, accessible from a TELNET login prompt.
332 CVE-2019-12797 798 2019-07-31 2019-08-22
7.5
None Remote Low Not required Partial Partial Partial
A clone version of an ELM327 OBD2 Bluetooth device has a hardcoded PIN, leading to arbitrary commands to an OBD-II bus of a vehicle.
333 CVE-2019-12776 798 2019-06-07 2019-06-10
10.0
None Remote Low Not required Complete Complete Complete
An issue was discovered on the ENTTEC Datagate MK2, Storm 24, Pixelator, and E-Streamer MK2 with firmware 70044_update_05032019-482. They include a hard-coded SSH backdoor for remote SSH and SCP access as the root user. A command in the relocate and relocate_revB scripts copies the hardcoded key to the root user's authorized_keys file, enabling anyone with the associated private key to gain remote root access to all affected products.
334 CVE-2019-12550 798 2019-06-17 2019-06-19
10.0
None Remote Low Not required Complete Complete Complete
WAGO 852-303 before FW06, 852-1305 before FW06, and 852-1505 before FW03 devices contain hardcoded users and passwords that can be used to login via SSH and TELNET.
335 CVE-2019-12549 798 2019-06-17 2019-06-19
10.0
None Remote Low Not required Complete Complete Complete
WAGO 852-303 before FW06, 852-1305 before FW06, and 852-1505 before FW03 devices contain hardcoded private keys for the SSH daemon. The fingerprint of the SSH host key from the corresponding SSH daemon matches the embedded private key.
336 CVE-2019-12376 798 2019-06-03 2019-06-26
2.7
None Local Network Low ??? Partial None None
Use of a hard-coded encryption key in Ivanti LANDESK Management Suite (LDMS, aka Endpoint Manager) 10.0.1.168 Service Update 5 may lead to full managed endpoint compromise by an authenticated user with read privileges.
337 CVE-2019-12327 798 2019-07-22 2019-10-09
10.0
None Remote Low Not required Complete Complete Complete
Hardcoded credentials in the Akuvox R50P VoIP phone 50.0.6.156 allow an attacker to get access to the device via telnet. The telnet service is running on port 2323; it cannot be turned off and the credentials cannot be changed.
338 CVE-2019-11947 798 Exec Code 2019-06-05 2019-06-06
9.0
None Remote Low ??? Complete Complete Complete
A remote code execution vulnerability was identified in HPE Intelligent Management Center (IMC) PLAT earlier than version 7.3 E0506P09.
339 CVE-2019-11898 798 2019-09-12 2019-10-09
6.5
None Remote Low ??? Partial Partial Partial
Unauthorized APE administration privileges can be achieved by reverse engineering one of the APE service tools. The service tool is discontinued with Bosch Access Professional Edition (APE) 3.8.
340 CVE-2019-11030 798 Exec Code 2019-08-22 2020-08-24
10.0
None Remote Low Not required Complete Complete Complete
Mirasys VMS before V7.6.1 and 8.x before V8.3.2 mishandles the Mirasys.Common.Utils.Security.DataCrypt method in Common.dll in AuditTrailService in SMServer.exe. This method triggers insecure deserialization within the .NET garbage collector, in which a gadget (contained in a serialized object) may be executed with SYSTEM privileges. The attacker must properly encrypt the object; however, the hardcoded keys are available.
341 CVE-2019-10995 798 2020-01-14 2020-01-24
5.8
None Local Network Low Not required Partial Partial Partial
ABB CP651 HMI products revision BSP UN30 v1.76 and prior implement hidden administrative accounts that are used during the provisioning phase of the HMI interface.
342 CVE-2019-10990 798 2019-09-23 2019-10-09
4.3
None Remote Medium Not required Partial None None
Red Lion Controls Crimson, version 3.0 and prior and version 3.1 prior to release 3112.00, uses a hard-coded password to encrypt protected files in transit and at rest, which may allow an attacker to access configuration files.
343 CVE-2019-10979 798 2019-07-01 2019-08-01
7.5
None Remote Low Not required Partial Partial Partial
SICK MSC800 all versions prior to Version 4.0, the affected firmware versions contain a hard-coded customer account password.
344 CVE-2019-10881 798 2021-04-13 2021-04-23
7.5
None Remote Low Not required Partial Partial Partial
Xerox AltaLink B8045/B8055/B8065/B8075/B8090, AltaLink C8030/C8035/C8045/C8055/C8070 with software releases before 103.xxx.030.32000 includes two accounts with weak hard-coded passwords which can be exploited and allow unauthorized access which cannot be disabled.
345 CVE-2019-10850 798 2019-05-23 2019-05-24
10.0
None Remote Low Not required Complete Complete Complete
Computrols CBAS 18.0.0 has Default Credentials.
346 CVE-2019-10712 798 2019-05-07 2020-10-01
7.5
None Remote Low Not required Partial Partial Partial
The Web-GUI on WAGO Series 750-88x (750-330, 750-352, 750-829, 750-831, 750-852, 750-880, 750-881, 750-882, 750-884, 750-885, 750-889) and Series 750-87x (750-830, 750-849, 750-871, 750-872, 750-873) devices has undocumented service access.
347 CVE-2019-10694 798 2019-12-12 2022-01-24
7.5
None Remote Low Not required Partial Partial Partial
The express install, which is the suggested way to install Puppet Enterprise, gives the user a URL at the end of the install to set the admin password. If they do not use that URL, there is an overlooked default password for the admin user. This was resolved in Puppet Enterprise 2019.0.3 and 2018.1.9.
348 CVE-2019-10688 798 2019-04-23 2019-06-17
4.6
None Local Low Not required Partial Partial Partial
VVX products with software versions including and prior to, UCS 5.9.2 with Better Together over Ethernet Connector (BToE) application 3.9.1, use hard-coded credentials to establish connections between the host application and the device.
349 CVE-2019-10479 798 2019-04-05 2019-04-09
10.0
None Remote Low Not required Complete Complete Complete
An issue was discovered on Glory RBW-100 devices with firmware ISP-K05-02 7.0.0. A hard-coded username and password were identified that allow a remote attacker to gain admin access to the Front Circle Controller web interface.
350 CVE-2019-10011 798 2019-03-25 2019-04-08
7.5
None Remote Low Not required Partial Partial Partial
ICS/StaticPages/AddTestUsers.aspx in Jenzabar JICS (aka Internet Campus Solution) before 2019-02-06 allows remote attackers to create an arbitrary number of accounts with a password of 1234.
Total number of vulnerabilities : 680   Page : 1 2 3 4 5 6 7 (This Page)8 9 10 11 12 13 14
CVE is a registred trademark of the MITRE Corporation and the authoritative source of CVE content is MITRE's CVE web site. CWE is a registred trademark of the MITRE Corporation and the authoritative source of CWE content is MITRE's CWE web site. OVAL is a registered trademark of The MITRE Corporation and the authoritative source of OVAL content is MITRE's OVAL web site.
Use of this information constitutes acceptance for use in an AS IS condition. There are NO warranties, implied or otherwise, with regard to this information or its use. Any use of this information is at the user's risk. It is the responsibility of user to evaluate the accuracy, completeness or usefulness of any information, opinion, advice or other content. EACH USER WILL BE SOLELY RESPONSIBLE FOR ANY consequences of his or her direct or indirect use of this web site. ALL WARRANTIES OF ANY KIND ARE EXPRESSLY DISCLAIMED. This site will NOT BE LIABLE FOR ANY DIRECT, INDIRECT or any other kind of loss.