10457 matches found
CVE-2023-49256
It is possible to download the configuration backup without authorization and decrypt included passwords using hardcoded static key...
CVE-2023-49256
It is possible to download the configuration backup without authorization and decrypt included passwords using hardcoded static key...
CVE-2023-49259
The authentication cookies are generated using an algorithm based on the username, hardcoded secret and the up-time, and can be guessed in a reasonable time...
CVE-2023-49253
Root user password is hardcoded into the device and cannot be changed in the user interface...
Hardcoded credentials
Root user password is hardcoded into the device and cannot be changed in the user interface...
Hardcoded credentials
The authentication cookies are generated using an algorithm based on the username, hardcoded secret and the up-time, and can be guessed in a reasonable time...
CVE-2023-49256 Predictable encryption passphrase used in publicly accessible configuration file
It is possible to download the configuration backup without authorization and decrypt included passwords using hardcoded static key...
CVE-2023-49253
CVE-2023-49253: The entry is supported by connected records (RH CVE) confirming a hardcoded root password that cannot be changed via the user interface. The vulnerability affects a device where the password is embedded in the firmware/UI and is not configurable by users. Impact is rated as Critic...
PT-2024-13713 · Hongdian · H8951-4G-Esp +1
Name of the Vulnerable Software and Affected Versions: No specific software or versions are mentioned in the provided descriptions. Description: The issue allows for the download of configuration backups without proper authorization. These backups contain passwords that can be decrypted using a...
CVE-2023-49256: Use of Hard-coded Cryptographic Key
It is possible to download the configuration backup without authorization and decrypt included passwords using hardcoded static key...
PT-2024-12180
Name of the Vulnerable Software and Affected Versions Škoda Superb III 3V3 - 2.0 TDI version 2022 Description The issue is related to a hardcoded secret value used for access to critical UDS services of the MIB3 infotainment. This hardcoded value is present in the firmware. The vulnerability was...
PT-2024-13710 · Device · Device
Name of the Vulnerable Software and Affected Versions: Device affected versions not specified Description: The root user password is hardcoded into the device and cannot be changed in the user interface. Additionally, there is an issue where a user's browser may be forced to execute JavaScript an...
PT-2024-13391 · Npm · @Evershop/Evershop
Name of the Vulnerable Software and Affected Versions: @evershop/evershop versions prior to 1.0.0-rc.8 Description: An issue was discovered in NPM's package @evershop/evershop where the HMAC secret used for generating tokens is hardcoded as "secret". This poses a risk because attackers can use th...
PT-2024-13716 · Hongdian · H8951-4G-Esp +1
Name of the Vulnerable Software and Affected Versions: No specific software or versions are mentioned in the provided descriptions. Description: The authentication cookies are generated using an algorithm based on the username, a hardcoded secret, and the up-time, and can be guessed in a reasonab...
MySQL Privilege Escalation
The vulnerability of the MySQL component in the software for managing power sources in Voltronic Power ViewPower Pro lies in the use of rigidly encoded credentials. Exploiting this vulnerability could allow an attacker to elevate their privileges to the level of an administrator...
PT-2024-1094 · D Link · D-Link Dcs-8300Lhv2
Name of the Vulnerable Software and Affected Versions: D-Link DCS-8300LHV2 Description: The issue is related to the configuration of the ONVIF API in the D-Link DCS-8300LHV2 Wi-Fi camera, which is associated with weaknesses in the authentication procedure. This allows a remote attacker to bypass...
D-Link DCS-8300LHV2 ONVIF Hardcoded PIN Authentication Bypass Vulnerability
This vulnerability allows network-adjacent attackers to bypass authentication on affected installations of D-Link DCS-8300LHV2 IP cameras. Authentication is not required to exploit this vulnerability. The specific flaw exists within the configuration of the ONVIF API. The issue results from the u...
Bosch Nexo cordless nutrunner security breach
Bosch Nexo Cordless nutrunner is a series of cordless tightening wrenches with integrated controls from Bosch Germany. A security vulnerability exists in Bosch Nexo cordless nutrunner. The vulnerability allows remote attackers to authenticate to the SSH service with root privileges via a hidden...