CWE-1392: Use of Default Credentials
The product uses default credentials (such as passwords or cryptographic keys) for potentially critical functionality.
A kind of CWE-1391 Use of Weak Credentials.
From the CWE List. © The MITRE Corporation.
Newest
- openidentityplatform openam OpenAM before 16.1.4 Default Credentials in Built-in Accounts Allow Unauthenticated Login 6.9 Medium
- hisense vidaa Hisense VIDAA Smart TV MQTT Broker Authentication Bypass 7.2 High
- i.r.i.s s.a. irispowerscan IRISPowerscan Default accounts with predictable credentials 7.2 High
- etrel d.o.o. inch Etrel INCH AC Charging Station Hard-coded Default Credentials 9.3 Critical
- delta electronics ufc500 Use of default password based on serial number 8.7 High
- delta electronics ufc500 Default WebUI passwords stored in plaintext 8.4 High
- boneio black debian images Use of Default Credentials in boneIO 7.1 High
- zephyrproject zephyr OpenThread joiner autostart uses a publicly documented default Joining Device Credential (PSKd) 7.5 High
- intranda goobi-viewer-core Goobi viewer: Empty webapi.authorization.token default permits unauthenticated authorization bypass 7.4 High
- eosphoros-ai db-gpt DB-GPT through 0.8.2 Hardcoded MySQL Root Credentials in docker-compose Deployment 9.3 Critical
- sunkaifei flycms FlyCms through commit edfdf724 Default Super Administrator Credentials 9.3 Critical
- vanus-labs vanus Vanus 0.8.0 through 0.9.0 Default Admin Credentials via Gateway 9.3 Critical
- databufflabs databuff DataBuff ai-apm-web through 0.1.10 Hard-Coded Default Admin Credentials 9.3 Critical
- juggleim JuggleIM im-server through 1.8.16 Default Admin Credentials in Admin Console 9.3 Critical
- prvtpro amnezia-web-panel PRVTPRO Amnezia-Web-Panel Backup Download app.py default credentials 6.9 Medium
- iflytek astron-agent Astron Agent: Unsandboxed code-node leads to cross-tenant RCE 9.9 Critical
- perfoce p4 (helix core) Authentication bypass via default auth token in P4Search 10.0 Critical
- innotim software, telecommunications and consultancy trade ltd. co. logsign siem Default Admin Credentials in Innotim Software's Logsign SIEM 9.8 Critical
- yzcheng90 x-springboot X-SpringBoot through 6.0 Authentication Bypass via Static Master Code 9.3 Critical
- cyber-iii student-management-system ningzichun student-management-system example_lite.sql default credentials 5.1 Medium
- 201206030 novel-plus novel-plus through 5.3.3 Default Cache Management Password in the Front Portal 6.9 Medium
- lenve vhr lenve vhr vhr.sql default credentials 6.9 Medium
- cisa malcolm Use of default credentials in Malcolm 9.2 Critical
- cisa malcolm Use of Default Credentials in Malcolm 8.2 High
- ibm contextforge, contextforge mcp gateway +1 more IBM ContextForge MCP Gateway is affected by use of default credentials 9.8 Critical
- eclipse foundation aerios In the current development version of Eclipse aeriOS, for which no official release has yet been... 9.9 Critical
- datiphy inc. data management center Datiphy Data Management Center - Use of Default Credentials 9.3 Critical
-
geolensPyPI GeoLens's authorization and cache-scope flaws disclose private dataset data and metadata to unauthorized users (fixed in 1.2.4) No score - andritz hipase-250, 250 scala +1 more Use of hard-coded VNC credentials in the engineering-workstation provisioning 8.1 High
- grisuno lazyown LazyOwn: Default C2 Operator Credentials Enable Administrative Access to C2 Dashboard 9.8 Critical
- care everywhere llc everywhere gateway Care Everywhere Gateway 14.3.10 Hard-coded Credentials RCE via WildFly 9.3 Critical
-
pheditor/pheditorPackagist Pheditor: Authentication Bypass in Forced Password-Change Flow via Unverified Current Password 10.0 Critical - sap se commerce cloud Insecure Sample Credentials in SAP Commerce Cloud 9.1 Critical
- ibm api connect IBM API Connect Default Credentials 8.1 High
- estrellaxd auto bangumi AutoBangumi < 3.2.8 - Hard-coded Default Credentials via add_default_user() 9.3 Critical
- jaiotlink c492a-w6 wi-fi ip camera JAIOTlink C492A-W6 4.8.30.57701411 Hard-coded Credentials via anyka_ipc 9.3 Critical
- opf openproject OpenProject: Pre-authentication RCE in openproject/openproject Docker image via default `SECRET_KEY_BASE=OVERWRITE_ME` and `cookies_serializer = :marshal` 9.9 Critical
- dell wyse management suite (wms), wyse management suite +1 more Dell Wyse Management Suite (WMS), versions prior to WMS 2605, contain a Use of Default... 6.0 Medium
- dell aiops, aiops collector +1 more Dell AIOps Collector versions prior to 1.18.3 contain a "Use of Default Credentials"... 7.8 High
- brickcom box, bullet, cube +1 more +3 more Brickcom Cameras Use of Default Credentials 8.3 High
- roche diagnostics navify digital pathology Vulnerability in navify® Digital Pathology 8.8 High
- danelec macgregor voyage data recorder (vdr) g4e, macgregor interschalt vdr g4e firmware +1 more MacGregor Voyage Data Recorder (VDR) G4e Use of Default Credentials 8.7 High
- rustfs RustFS: Internode RPC HMAC secret falls back to public default credential, enabling peer impersonation 9.8 Critical
- ibm operations analytics - log analysis, operations analytics log analysis +1 more IBM Operations Analytics - Log Analysis is affected by Information disclosure due to default passwords not being forced to be changed on post-installation 8.4 High
- ibm cloud pak for data system - cyclops Vulnerabilities exists in IBM Cloud Pak for Data System (CPDS 1.0) - Cyclops. 5.3 Medium
- tyler technologies tid-l Tyler Identity Local (TID-L) default administrative credentials 9.3 Critical
- google cloud alloydb for postgresql Insecure default administrative credentials in AlloyDB for PostgreSQL 9.2 Critical
- orneryd nornicdb Nornicdb: Improper Network Binding in NornicDB Bolt Server allows unauthorized remote access 9.8 Critical
- netbox-community netbox-docker netbox-docker before 2.5.0 has a superuser account with default credentials (admin password for... 9.0 Critical
- istio, red hat cert-manager operator for red hat openshift, externaldns operator +10 more +12 more Istio JWKS resolver to prevent private key material from being exposed when JWKS fetch fails. 8.7 High
- Show olderLoading…