318 matches found
CVE-2023-46943
An issue was discovered in NPM's package @evershop/evershop before version 1.0.0-rc.8. The HMAC secret used for generating tokens is hardcoded as "secret". A weak HMAC secret poses a risk because attackers can use the predictable secret to create valid JSON Web Tokens JWTs, allowing them access t...
CVE-2023-28897
The secret value used for access to critical UDS services of the MIB3 infotainment is hardcoded in the firmware. Vulnerability discovered on Škoda Superb III 3V3 - 2.0 TDI manufactured in 2022...
CVE-2023-28897
The secret value used for access to critical UDS services of the MIB3 infotainment is hardcoded in the firmware. Vulnerability discovered on Škoda Superb III 3V3 - 2.0 TDI manufactured in 2022...
CVE-2023-49259
The authentication cookies are generated using an algorithm based on the username, hardcoded secret and the up-time, and can be guessed in a reasonable time...
PT-2024-13391 · Npm · @Evershop/Evershop
Name of the Vulnerable Software and Affected Versions: @evershop/evershop versions prior to 1.0.0-rc.8 Description: An issue was discovered in NPM's package @evershop/evershop where the HMAC secret used for generating tokens is hardcoded as "secret". This poses a risk because attackers can use th...
PT-2024-12180
Name of the Vulnerable Software and Affected Versions Škoda Superb III 3V3 - 2.0 TDI version 2022 Description The issue is related to a hardcoded secret value used for access to critical UDS services of the MIB3 infotainment. This hardcoded value is present in the firmware. The vulnerability was...
PT-2024-13716 · Hongdian · H8951-4G-Esp +1
Name of the Vulnerable Software and Affected Versions: No specific software or versions are mentioned in the provided descriptions. Description: The authentication cookies are generated using an algorithm based on the username, a hardcoded secret, and the up-time, and can be guessed in a reasonab...
Headwind MDM Trust Management Issue Vulnerabilities
Headwind MDM is a platform for managing Android devices in the enterprise. A trust management issue vulnerability exists in Headwind MDM Web panel version 5.22.1, which stems from the use of hardcoding in JWT Secret, resulting in an access control error...
PT-2023-28983
Name of the Vulnerable Software and Affected Versions Label Studio versions prior to 1.8.2 Description There is a vulnerability in Label Studio that can be chained with an Object Relational Mapper ORM Leak vulnerability to impersonate any account on the platform. An attacker could exploit these...
SUSE CVE-2017-7537
It was found that a mock CMC authentication plugin with a hardcoded secret was accidentally enabled by default in the pki-core package before 10.6.4. An attacker could potentially use this flaw to bypass the regular authentication process and trick the CA server into issuing certificates...
CVE-2022-43978 Limited Authentication bypass due to hardcoded secret
There is an improper authentication vulnerability in Pandora FMS v764. The application verifies that the user has a valid session when he is not trying to do a login. Since the secret is static in generatePublicHash function, an attacker with knowledge of a valid session can abuse this in order t...
Authentication flaw
Izanami is a shared configuration service well-suited for micro-service architecture implementation. Attackers can bypass the authentication in this application when deployed using the official Docker image. Because a hard coded secret is used to sign the authentication token JWT, an attacker cou...
CVE-2023-22495
Izanami is a shared configuration service well-suited for micro-service architecture implementation. Attackers can bypass the authentication in this application when deployed using the official Docker image. Because a hard coded secret is used to sign the authentication token JWT, an attacker cou...
Hell’s Keychain: Supply-chain vulnerability in IBM Cloud Databases for PostgreSQL allows potential unauthorized database access
How IBM Cloud caught us exploring its infrastructure and how a hardcoded secret eventually led to build artifact access and manipulation...
CVE-2020-15331
Zyxel CloudCNM SecuManager 3.1.0 and 3.1.1 has a hardcoded OAUTHSECRETKEY in /opt/axess/etc/default/axess...
CVE-2022-35540
Hardcoded JWT Secret in AgileConfig 1.6.8 Server allows remote attackers to use the generated JWT token to gain administrator access...
PT-2022-22898 · Unknown · Agileconfig
Name of the Vulnerable Software and Affected Versions: AgileConfig versions prior to 1.6.8 Description: The issue allows remote attackers to gain administrator access by utilizing a hardcoded JWT Secret in the AgileConfig Server. This can be achieved by using the generated JWT token...
GitHub Security Lab: Golang : Hardcoded secret used for signing JWT
This bug was reported directly to GitHub Security Lab...
Privilege Escalation
freetakserver is vulnerable to privilege escalation. The vulnerability exists due to a hardcoded Flask secret key allowing an attacker to create crafted cookies to bypass authentication or escalate privileges...