CWE-798

{
  "affected": [],
  "aliases": [
    "CVE-2021-22667"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-798"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2021-02-24T17:15:00Z",
    "severity": "CRITICAL"
  },
  "details": "BB-ESWGP506-2SFP-T versions 1.01.09 and prior is vulnerable due to the use of hard-coded credentials, which may allow an attacker to gain unauthorized access and permit the execution of arbitrary code on the BB-ESWGP506-2SFP-T (versions 1.01.01 and prior).",
  "id": "GHSA-8m2w-rpr3-g4wf",
  "modified": "2022-05-28T00:00:22Z",
  "published": "2022-05-24T17:43:02Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-22667"
    },
    {
      "type": "WEB",
      "url": "https://us-cert.cisa.gov/ics/advisories/icsa-21-054-02"
    },
    {
      "type": "WEB",
      "url": "https://www.zerodayinitiative.com/advisories/ZDI-21-593"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ]
}

{
  "affected": [],
  "aliases": [
    "CVE-2019-14482"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-798"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2020-12-16T16:15:00Z",
    "severity": "CRITICAL"
  },
  "details": "AdRem NetCrunch 10.6.0.4587 has a hardcoded SSL private key vulnerability in the NetCrunch web client. The same hardcoded SSL private key is used across different customers\u0027 installations when no other SSL certificate is installed, which allows remote attackers to defeat cryptographic protection mechanisms by leveraging knowledge of this key from another installation.",
  "id": "GHSA-8m3r-g5w3-m8m2",
  "modified": "2024-04-04T03:03:44Z",
  "published": "2022-05-24T17:36:38Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-14482"
    },
    {
      "type": "WEB",
      "url": "https://compass-security.com/fileadmin/Research/Advisories/2020-16_CSNC-2019-017_AdRem_NetCrunch_Hardcoded_SSL_Private_Key.txt"
    },
    {
      "type": "WEB",
      "url": "https://www.adremsoft.com/support"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ]
}

{
  "affected": [],
  "aliases": [
    "CVE-2024-40410"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-798"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2024-11-13T23:15:04Z",
    "severity": "MODERATE"
  },
  "details": "Cybele Software Thinfinity Workspace before v7.0.2.113 was discovered to contain a hardcoded cryptographic key used for encryption.",
  "id": "GHSA-8m8g-4g6j-89fc",
  "modified": "2024-11-25T21:30:48Z",
  "published": "2024-11-14T00:31:11Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-40410"
    },
    {
      "type": "WEB",
      "url": "https://blog.cybelesoft.com/thinfinity-workspace-security-bulletin-nov-2024"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N",
      "type": "CVSS_V3"
    }
  ]
}

{
  "affected": [],
  "aliases": [
    "CVE-2023-49221"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-798"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2024-06-07T20:15:10Z",
    "severity": "HIGH"
  },
  "details": "Precor touchscreen console P62, P80, and P82 could allow a remote attacker (within the local network) to bypass security restrictions, and access the service menu, because there is a hard-coded service code.",
  "id": "GHSA-8mcw-ghrq-qxqc",
  "modified": "2024-08-20T18:31:15Z",
  "published": "2024-06-07T21:31:54Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-49221"
    },
    {
      "type": "WEB",
      "url": "https://securityintelligence.com/x-force/internet-connected-treadmill-vulnerabilities-discovered"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ]
}

{
  "affected": [],
  "aliases": [
    "CVE-2025-15628"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-798"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2026-08-03T19:16:40Z",
    "severity": "HIGH"
  },
  "details": "Affected\nOmada devices rely on embedded certificates that are shared across deployments\nto establish trust between controllers and managed devices.\n\n\n\n\n\n\n\n\n\nAn attacker\nwho obtains the embedded certificates may be able to impersonate trusted\ncontrollers or devices and intercept affected communications.",
  "id": "GHSA-8mhg-76f5-54fp",
  "modified": "2026-08-07T15:33:03Z",
  "published": "2026-08-03T21:31:35Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-15628"
    },
    {
      "type": "WEB",
      "url": "https://www.omadanetworks.com/en/support/download"
    },
    {
      "type": "WEB",
      "url": "https://www.omadanetworks.com/us/support/download"
    },
    {
      "type": "WEB",
      "url": "https://www.tp-link.com/us/support/faq/5216"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
      "type": "CVSS_V3"
    },
    {
      "score": "CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:P/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
      "type": "CVSS_V4"
    }
  ]
}

{
  "affected": [],
  "aliases": [
    "CVE-2021-27797"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-798"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2022-02-21T18:15:00Z",
    "severity": "CRITICAL"
  },
  "details": "Brocade Fabric OS before Brocade Fabric OS v8.2.1c, v8.1.2h, and all versions of Brocade Fabric OS v8.0.x and v7.x contain documented hard-coded credentials, which could allow attackers to gain access to the system.",
  "id": "GHSA-8p54-mp5c-w59g",
  "modified": "2022-03-02T00:00:32Z",
  "published": "2022-02-22T00:00:23Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-27797"
    },
    {
      "type": "WEB",
      "url": "https://www.broadcom.com/support/fibre-channel-networking/security-advisories/brocade-security-advisory-2021-1722"
    }
  ],
  "schema_version": "1.4.0",
  "severity": []
}

{
  "affected": [],
  "aliases": [
    "CVE-2025-46617"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-798"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2025-04-25T07:15:48Z",
    "severity": "HIGH"
  },
  "details": "Quantum StorNext Web GUI API before 7.2.4 grants access to internal StorNext configuration and unauthorized modification of some software configuration parameters via undocumented user credentials. This affects StorNext RYO before 7.2.4, StorNext Xcellis Workflow Director before 7.2.4, and ActiveScale Cold Storage.",
  "id": "GHSA-8p8h-vpmc-q8xq",
  "modified": "2025-04-25T09:31:49Z",
  "published": "2025-04-25T09:31:49Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-46617"
    },
    {
      "type": "WEB",
      "url": "https://www.quantum.com/en/service-support/security-bulletins/stornext-gui-multiple-security-vulnerabilities-stornext-gui-multiple-security-vulnerabilities"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N",
      "type": "CVSS_V3"
    }
  ]
}

{
  "affected": [
    {
      "package": {
        "ecosystem": "PyPI",
        "name": "ogham-mcp"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0.6.3"
            },
            {
              "fixed": "0.11.1"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [],
  "database_specific": {
    "cwe_ids": [
      "CWE-798"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-05-05T00:03:48Z",
    "nvd_published_at": null,
    "severity": "MODERATE"
  },
  "details": "## Summary\n\nBetween 2026-02 and 2026-04-24 a total of 22 public PyPI sdists of `ogham-mcp` contained development credentials embedded in source files. All credentials have since been rotated on the respective providers. No known exploitation. Upgrade to **v0.11.1** to get a clean release.\n\n## What was leaked\n\n| Credential | Location in sdist | Vulnerable range | Count |\n|---|---|---|---|\n| 3x Neon postgres URLs with passwords (US / EU / AP development databases) | top-level `Makefile` (`NEON_US`, `NEON_EU`, `NEON_AP` vars) | `\u003e=0.6.5, \u003c0.11.0` | 21 sdists |\n| 1x Voyage AI API key (`pa-...`) | `tests/test_hooks.py::test_mask_secrets_key_value` -- test fixture that fed a real key into the redaction-function tester | `\u003e=0.6.3, \u003c0.11.1` | 22 sdists |\n\n## Impact\n\n- **Primary risk**: any consumer of the affected sdists could have extracted the credentials and used them. The Neon URLs pointed at development databases; the Voyage key was a rate-limited API key.\n- **Observed exploitation**: none detected. Audit logs on both providers were reviewed post-rotation.\n- **Remediation on our side**:\n  - Neon passwords for all three regions rotated.\n  - Voyage API key rotated.\n  - All affected versions yanked from PyPI (v0.3.0 through v0.10.4 yanked on 2026-04-24; v0.11.0 pending yank after this advisory).\n  - v0.11.0 removed the Neon URLs and introduced `make publish-check` which scans every sdist for credential patterns before upload.\n  - v0.11.1 scrubs the Voyage key from the test fixture and excludes `benchmarks/`, `docs/`, `research/`, `extras/`, and `**/*.env*` from all future sdists via explicit hatchling sdist include/exclude in `pyproject.toml`.\n\n## Action for users\n\n- If users installed any version from `v0.3.0` through `v0.11.0`, upgrade to **v0.11.1** immediately:\n  ```\n  pip install --upgrade \"ogham-mcp\u003e=0.11.1\"\n  ```\n- Users do not need to rotate anything on their end. The leaked credentials were owned by the project maintainer, not by users.\n\n## Credit\n\nDiscovered during an internal pre-release audit on 2026-04-24 while preparing v0.11.1.",
  "id": "GHSA-8pqq-224h-x875",
  "modified": "2026-05-05T00:03:49Z",
  "published": "2026-05-05T00:03:48Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/ogham-mcp/ogham-mcp/security/advisories/GHSA-8pqq-224h-x875"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/ogham-mcp/ogham-mcp"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [],
  "summary": "ogham-mcp had credentials embedded in published PyPI sdists -- Neon postgres URLs and Voyage API key"
}

{
  "affected": [],
  "aliases": [
    "CVE-2017-6022"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-259",
      "CWE-798"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2017-06-30T03:29:00Z",
    "severity": "CRITICAL"
  },
  "details": "A hard-coded password issue was discovered in Becton, Dickinson and Company (BD) PerformA, Version 2.0.14.0 and prior versions, and KLA Journal Service, Version 1.0.51 and prior versions. They use hard-coded passwords to access the BD Kiestra Database, which could be leveraged to compromise the confidentiality of limited PHI/PII information stored in the BD Kiestra Database.",
  "id": "GHSA-8q2j-7m4j-w338",
  "modified": "2022-05-13T01:36:36Z",
  "published": "2022-05-13T01:36:36Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2017-6022"
    },
    {
      "type": "WEB",
      "url": "https://ics-cert.us-cert.gov/advisories/ICSMA-17-082-01"
    },
    {
      "type": "WEB",
      "url": "http://www.securityfocus.com/bid/97057"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ]
}

{
  "affected": [],
  "aliases": [
    "CVE-2021-34757"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-200",
      "CWE-798"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2021-10-06T20:15:00Z",
    "severity": "MODERATE"
  },
  "details": "Multiple vulnerabilities in Cisco Business 220 Series Smart Switches firmware could allow an attacker with Administrator privileges to access sensitive login credentials or reconfigure the passwords on the user account. For more information about these vulnerabilities, see the Details section of this advisory.",
  "id": "GHSA-8q5v-c5jp-qp9p",
  "modified": "2022-10-24T19:00:23Z",
  "published": "2022-05-24T19:16:40Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-34757"
    },
    {
      "type": "WEB",
      "url": "https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-sb-hardcoded-cred-MJCEXvX"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:P/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N",
      "type": "CVSS_V3"
    }
  ]
}