Use of Hard-coded, Security-relevant Constants
CWE-547
The product uses hard-coded constants instead of symbolic names for security-critical values, which increases the likelihood of mistakes during code maintenance or security policy change.
We track 7 vulnerabilities of this type. 100% are rated high or critical, and the average CVSS score is 8.8.
How this weakness is prevented
- Implementation: Avoid using hard-coded constants. Configuration files offer a more flexible solution.
Latest Use of Hard-coded, Security-relevant Constants vulnerabilities
- 9.8 Critical severity
Jumis: Use of Hard-coded, Security-relevant Constants
Jumis (formerly Tildes Jumis) creates and uses a Microsoft SQL Server login named ##Tilde_JumisAdmin## whose password is derived deterministically from a single non-secret input - the SQL Server name (@@servername). The derivation algorithm is hard-coded in th
- 9.8 Critical severity
Tracer SC: Use of Hard-coded, Security-relevant Constants
A Use of Hard-coded, Security-relevant Constants vulnerability in Trane Tracer SC, Tracer SC+, and Tracer Concierge could allow an attacker to disclose sensitive information and take over accounts.
- 9.8 Critical severity
dpanel: Use of Hard-coded Cryptographic Key
Dpanel is a Docker visualization panel system which provides complete Docker management functions. The Dpanel service contains a hardcoded JWT secret in its default configuration, allowing attackers to generate valid JWT tokens and compromise the host machine.
- 8.7 High severity
Visual BACnet Capture Tool: Use of Hard-coded, Security-relevant Constants
Optigo Networks Visual BACnet Capture Tool and Optigo Visual Networks Capture Tool version 3.1.2rc11 are vulnerable to an attacker impersonating the web application service and mislead victim clients.
- 8.7 High severity
Visual BACnet Capture Tool: Use of Hard-coded, Security-relevant Constants
Optigo Networks Visual BACnet Capture Tool and Optigo Visual Networks Capture Tool version 3.1.2rc11 contain a hard coded secret key. This could allow an attacker to generate valid JWT (JSON Web Token) sessions.
- 7.5 High severity
Mendix Encryption: Use of Hard-coded, Security-relevant Constants
A vulnerability has been identified in Mendix Encryption (All versions >= V10.0.0 < V10.0.2). Affected versions of the module define a specific hard-coded default value for the EncryptionKey constant, which is used in projects where no individual EncryptionKey
- 7.1 High severity
git: Use of Hard-coded, Security-relevant Constants
Git is a revision control system. Prior to versions 2.45.1, 2.44.1, 2.43.4, 2.42.2, 2.41.1, 2.40.2, and 2.39.4, when cloning a local source repository that contains symlinks via the filesystem, Git may create hardlinks to arbitrary user-readable files on the s